Package Search Help
You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package (implicit)
name:my-package (explicit)
Search by package filename:
filename:my-package.ext
Search by package tag:
tag:latest
Search by package version:
version:1.0.0
prerelease:true (prereleases)
prerelease:false (no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Search queries for all Generic-specific package types
Search by file path:
generic_filepath:path/to/file.txt
Search by directory:
generic_directory:path/to
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo for negation
For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching
For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal
Need a secure and centralised artifact repository to deliver Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Generic,
Go,
Helm,
Hex,
HuggingFace,
LuaRocks,
Maven,
MCP,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
VSX,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
cloudsmith
(Cloudsmith)
/
actions-images
Docker Images used to power Cloudsmith's Github Action
python
3.8-slim-amd64
One-liner (summary)
A certifiably-awesome package curated by Patrick Carey, hosted by Cloudsmith.
Description
A certifiably-awesome package curated by Patrick Carey, hosted by Cloudsmith.
| Status | Completed |
|---|---|
| Checksum (MD5) | 1fc35065eab9cb09308744c2aaf761bf |
| Checksum (SHA-1) | 41749a82f3b003d956661b9e2c62c509774daf79 |
| Checksum (SHA-256) | b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d |
| Checksum (SHA-512) | d8f27f109f6cbae60be834d3e6bbedeefef19437888d09b3606faa4220d73150ee… |
| GPG Signature | |
| GPG Fingerprint | c760ab75833fbab6512e8bc3fb264c86fc0ae1c8 |
| Storage Region | Dublin, Ireland |
| Type | Binary (contains binaries and binary artifacts) |
| Uploaded At | 3 years, 7 months ago |
| Uploaded By |
|
| Slug Id | python-T0a |
| Unique Id | msfX5AAOgXH3 |
| Version (Raw) | 3.8-slim-amd64 |
| Version (Parsed) |
|
| Orig Version (Raw) | b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d |
| Orig Version (Parsed) |
|
| docker-specific metadata | |
| Image Digest | sha256:b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d |
| Config Digest | sha256:3b03c341683c1bd6ce7309a11a506d2021212419cfdb292ba3e53119e7ca4fde |
| V1 OCI Index Digest | sha256:6e84a6b1eadfc0db8f9db5caa72a32b53b8969b36a9757f66c076862620ec693 |
| V1 Distribution (Signed) Digest | sha256:ae5edafd084544099d0a63b6c6e1dcbacce23faecd3a32ecfaf22113efecfb06 |
| V1 OCI Digest | sha256:e85143b4b08a863e0733ce1a82d6468c39e535943bdad05c4c43c2401f3d1771 |
| V2 Distribution List Digest | sha256:d571aacf8cd108be592fdeee03edfeb8d3a499cfcf1e0e4f1f9f5011a4f19a2b |
| V1 Distribution Digest | sha256:7df9c8088d5e80e110dba07cc98bf38aec62b544b755b0465d77ff921e960e98 |
| V2 Distribution Digest | sha256:b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d |
| extended metadata | |
| Manifest Type | V2 Distribution |
| Architecture | amd64 |
| Config | |
| Container | d9973be385002f59be475990dd39bb674e810887a539358fc95d7ac2e74a4d6e |
| Container Config | |
| Created | 2022-12-06 15:30:35 UTC |
| Docker Version | 20.10.12 |
| Os | linux |
This package was uploaded with the following V2 Distribution manifest:
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"config": {
"mediaType": "application/vnd.docker.container.image.v1+json",
"size": 7533,
"digest": "sha256:70eea1c77e607936d5f24ae36499e053359366360954f97c8726e2be79a59aa5"
},
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 31412852,
"digest": "sha256:025c56f98b679f70b7a54241917e56da7b59ab9d2defecc6ebdb0bf2750484bb"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 1077978,
"digest": "sha256:778656c04542093db6d3b6e07bffbcf6ec4b24709276be7cdf177fcb3666663a"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 11336193,
"digest": "sha256:2f533501106783d24b8849738de457b6cf05fa9099af32bced03062e07eda3d8"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 233,
"digest": "sha256:6b453dd3c3d536990e0f5f7ce48c4543371f54c1c52fbcc715310cc3221e47cb"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 3178956,
"digest": "sha256:7ac12e878811912f8568b2815b0f875f570a01aacb21f172bf8f4023a83b8d0c"
}
]
}|
Digest:
sha256:025c56f98b679f70b7a54241917e56da7b59ab9d2defecc6ebdb0bf2750484bb
Command: /bin/sh -c #(nop) ADD file:1f1efd56601ebc26a041a7b994a380ef68112b91a078e225753bee7b3196d22c in / |
30.0 MB | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) CMD ["bash"] |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV LANG=C.UTF-8 |
32 bytes | ||
|
Digest:
sha256:778656c04542093db6d3b6e07bffbcf6ec4b24709276be7cdf177fcb3666663a
Command: /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates netbase tzdata ; rm -rf /var/lib/apt/lists/* |
1.0 MB | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV GPG_KEY=E3FF2839C048B25C084DEBE9B26995E310250568 |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PYTHON_VERSION=3.8.15 |
32 bytes | ||
|
Digest:
sha256:2f533501106783d24b8849738de457b6cf05fa9099af32bced03062e07eda3d8
Command: /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends dpkg-dev gcc gnupg dirmngr libbluetooth-dev libbz2-dev libc6-dev libexpat1-dev libffi-dev libgdbm-dev liblzma-dev libncursesw5-dev libreadline-dev libsqlite3-dev libssl-dev make tk-dev uuid-dev wget xz-utils zlib1g-dev ; wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc"; GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$GPG_KEY"; gpg --batch --verify python.tar.xz.asc python.tar.xz; command -v gpgconf > /dev/null && gpgconf --kill all || :; rm -rf "$GNUPGHOME" python.tar.xz.asc; mkdir -p /usr/src/python; tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; rm python.tar.xz; cd /usr/src/python; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; ./configure --build="$gnuArch" --enable-loadable-sqlite-extensions --enable-optimizations --enable-option-checking=fatal --enable-shared --with-system-expat --without-ensurepip ; nproc="$(nproc)"; make -j "$nproc" LDFLAGS="-Wl,--strip-all" ; make install; cd /; rm -rf /usr/src/python; find /usr/local -depth \( \( -type d -a \( -name test -o -name tests -o -name idle_test \) \) -o \( -type f -a \( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \) \) -o \( -type f -a -name 'wininst-*.exe' \) \) -exec rm -rf '{}' + ; ldconfig; apt-mark auto '.*' > /dev/null; apt-mark manual $savedAptMark; find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' | awk '/=>/ { print $(NF-1) }' | sort -u | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; rm -rf /var/lib/apt/lists/*; python3 --version |
10.8 MB | ||
|
Digest:
sha256:6b453dd3c3d536990e0f5f7ce48c4543371f54c1c52fbcc715310cc3221e47cb
Command: /bin/sh -c set -eux; for src in idle3 pydoc3 python3 python3-config; do dst="$(echo "$src" | tr -d 3)"; [ -s "/usr/local/bin/$src" ]; [ ! -e "/usr/local/bin/$dst" ]; ln -svT "$src" "/usr/local/bin/$dst"; done |
233 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PYTHON_PIP_VERSION=22.0.4 |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PYTHON_SETUPTOOLS_VERSION=57.5.0 |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/66030fa03382b4914d4c4d0896961a0bdeeeb274/public/get-pip.py |
32 bytes | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) ENV PYTHON_GET_PIP_SHA256=1e501cf004eac1b7eb1f97266d28f995ae835d30250bec7f8850562703067dc6 |
32 bytes | ||
|
Digest:
sha256:7ac12e878811912f8568b2815b0f875f570a01aacb21f172bf8f4023a83b8d0c
Command: /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends wget; wget -O get-pip.py "$PYTHON_GET_PIP_URL"; echo "$PYTHON_GET_PIP_SHA256 *get-pip.py" | sha256sum -c -; apt-mark auto '.*' > /dev/null; [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; rm -rf /var/lib/apt/lists/*; export PYTHONDONTWRITEBYTECODE=1; python get-pip.py --disable-pip-version-check --no-cache-dir --no-compile "pip==$PYTHON_PIP_VERSION" "setuptools==$PYTHON_SETUPTOOLS_VERSION" ; rm -f get-pip.py; pip --version |
3.0 MB | ||
|
Digest:
sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Command: /bin/sh -c #(nop) CMD ["python3"] |
32 bytes |
Last scanned
4 days, 22 hours ago
Scan result
Vulnerable
Vulnerability count
261
Max. severity
Critical| Target: | msfX5AAOgXH3.sbom-cyclonedx.json (debian 11.5) | |
| CRITICAL |
CVE-2019-8457: sqlite: heap out-of-bound read in function rtreenode()SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.Package Name: libdb5.3 Installed Version: 5.3.28+dfsg1-0.8 Fixed Version: References: lists.opensuse.org access.redhat.com kc.mcafee.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com usn.ubuntu.com usn.ubuntu.com usn.ubuntu.com usn.ubuntu.com www.cve.org www.oracle.com www.oracle.com www.oracle.com www.oracle.com www.sqlite.org www.sqlite.org |
|
| CRITICAL |
CVE-2024-45491: libexpat: Integer Overflow or WraparoundAn issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: 2.2.10-2+deb11u6 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| CRITICAL |
CVE-2024-45492: libexpat: integer overflowAn issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: 2.2.10-2+deb11u6 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| CRITICAL |
CVE-2026-33845: gnutls: GnuTLS: Denial of Service via DTLS zero-length fragmentA flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.access.redhat.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| CRITICAL |
CVE-2026-42010: gnutls: gnutls: Authentication Bypass via NUL Character in UsernameA flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.access.redhat.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| CRITICAL |
CVE-2024-37371: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org www.oracle.com |
|
| CRITICAL |
CVE-2024-37371: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org www.oracle.com |
|
| CRITICAL |
CVE-2024-37371: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org www.oracle.com |
|
| CRITICAL |
CVE-2024-37371: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org www.oracle.com |
|
| CRITICAL |
CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OKGNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.Package Name: libtasn1-6 Installed Version: 4.16.0-2 Fixed Version: 4.16.0-2+deb11u1 References: access.redhat.com access.redhat.com bugs.gentoo.org bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gitlab.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| CRITICAL |
CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expres ...Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com github.com github.com |
|
| CRITICAL |
CVE-2026-42496: perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file accessArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.security.metacpan.org metacpan.org nvd.nist.gov security.access.redhat.com ubuntu.com www.cve.org www.cve.org |
|
| CRITICAL |
CVE-2026-8376: perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit buildsPerl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov ubuntu.com www.cve.org |
|
| CRITICAL |
CVE-2023-45853: zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.Package Name: zlib1g Installed Version: 1:1.2.11.dfsg-2+deb11u2 Fixed Version: References: www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com chromium.googlesource.com chromium.googlesource.com github.com github.com github.com github.com github.com lists.debian.org nvd.nist.gov pypi.org security.gentoo.org security.netapp.com security.netapp.com ubuntu.com www.cve.org www.winimage.com |
|
| HIGH |
CVE-2022-3715: bash: a heap-buffer-overflow in valid_parameter_transformA flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.Package Name: bash Installed Version: 5.1-2+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2022-1304: e2fsprogs: out-of-bounds read/write via crafted filesystemAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.Package Name: e2fsprogs Installed Version: 1.46.2-2 Fixed Version: 1.46.2-2+deb11u1 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org marc.info nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-68973: GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds writeIn GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)Package Name: gpgv Installed Version: 2.2.27-2+deb11u2 Fixed Version: 2.2.27-2+deb11u3 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org dev.gnupg.org dev.gnupg.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.com gpg.fail linux.oracle.com linux.oracle.com lists.debian.org media.ccc.de news.ycombinator.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-41992: GNU gzip contains a global buffer overflow vulnerability in the LZH de ...GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681Package Name: gzip Installed Version: 1.10-4+deb11u1 Fixed Version: References: cert.pl cgit.git.savannah.gnu.org nvd.nist.gov ubuntu.com www.cve.org www.gnu.org |
|
| HIGH |
CVE-2026-54369: acl: Symlink traversal privilege escalation via libacl functionsacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.Package Name: libacl1 Installed Version: 2.2.53-10 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com cgit.git.savannah.nongnu.org cgit.git.savannah.nongnu.org nvd.nist.gov security.access.redhat.com www.cve.org www.vulncheck.com |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2023-4911: glibc: buffer overflow in ld.so leading to privilege escalationA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u7 References: cve.mitre.org packetstormsecurity.com packetstormsecurity.com seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com www.cisa.gov www.cisa.gov www.cve.org www.debian.org www.exploit-db.com www.qualys.com www.qualys.com |
|
| HIGH |
CVE-2024-2961: glibc: Out of bounds write in iconv may lead to remote code executionThe iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u9 References: cve.mitre.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com ubuntu.com ubuntu.com www.ambionics.io www.ambionics.io www.ambionics.io www.cve.org www.openwall.com |
|
| HIGH |
CVE-2024-33599: glibc: stack-based buffer overflow in netgroup cachenscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2023-4911: glibc: buffer overflow in ld.so leading to privilege escalationA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u7 References: cve.mitre.org packetstormsecurity.com packetstormsecurity.com seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com www.cisa.gov www.cisa.gov www.cve.org www.debian.org www.exploit-db.com www.qualys.com www.qualys.com |
|
| HIGH |
CVE-2024-2961: glibc: Out of bounds write in iconv may lead to remote code executionThe iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u9 References: cve.mitre.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com ubuntu.com ubuntu.com www.ambionics.io www.ambionics.io www.ambionics.io www.cve.org www.openwall.com |
|
| HIGH |
CVE-2024-33599: glibc: stack-based buffer overflow in netgroup cachenscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2022-1304: e2fsprogs: out-of-bounds read/write via crafted filesystemAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.Package Name: libcom-err2 Installed Version: 1.46.2-2 Fixed Version: 1.46.2-2+deb11u1 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org marc.info nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-52425: expat: parsing large tokens can trigger a denial of servicelibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: 2.2.10-2+deb11u6 References: cve.mitre.org www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2024-45490: libexpat: Negative Length Parsing Vulnerability in libexpatAn issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: 2.2.10-2+deb11u6 References: cve.mitre.org seclists.org seclists.org seclists.org seclists.org seclists.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-59375: firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsinglibexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: cve.mitre.org www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com issues.oss-fuzz.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.mozilla.org www.mozilla.org |
|
| HIGH |
CVE-2026-25210: libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocationIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com nvd.nist.gov ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-45186: libexpat: denial of service via crafted XML inputIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.access.redhat.com www.cve.org |
|
| HIGH |
CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to X ...libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: github.com nvd.nist.gov |
|
| HIGH |
CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog that is rela ...libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: github.com nvd.nist.gov |
|
| HIGH |
CVE-2026-56408: libexpat before 2.8.2 has an integer overflow in copyString.libexpat before 2.8.2 has an integer overflow in copyString.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: github.com nvd.nist.gov |
|
| HIGH |
CVE-2022-1304: e2fsprogs: out-of-bounds read/write via crafted filesystemAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.Package Name: libext2fs2 Installed Version: 1.46.2-2 Fixed Version: 1.46.2-2+deb11u1 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org marc.info nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2021-33560: libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powmLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.Package Name: libgcrypt20 Installed Version: 1.8.7-6 Fixed Version: References: access.redhat.com access.redhat.com dev.gnupg.org dev.gnupg.org dev.gnupg.org dev.gnupg.org eprint.iacr.org errata.almalinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org ubuntu.com ubuntu.com www.cve.org www.oracle.com www.oracle.com www.oracle.com www.oracle.com |
|
| HIGH |
CVE-2023-0361: gnutls: timing side-channel in the TLS RSA key exchange codeA timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u3 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com gitlab.com gnutls.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2024-0553: gnutls: incomplete fix for CVE-2023-5981A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gnutls.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.gnupg.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2024-0567: gnutls: rejects certificate chain with distributed trustA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org gitlab.com gnutls.org linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.gnupg.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-32988: gnutls: Vulnerability in GnuTLS otherName SAN exportA flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u8 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-32990: gnutls: Vulnerability in GnuTLS certtool template parsingA heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u8 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-33846: gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassemblyA heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.access.redhat.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| HIGH |
CVE-2026-3833: gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparisonA flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| HIGH |
CVE-2026-42009: gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerabilityA flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.access.redhat.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| HIGH |
CVE-2024-37370: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanismIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds readIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2024-37370: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanismIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds readIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2024-37370: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanismIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds readIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2024-37370: krb5: GSS message token handlingIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com web.mit.edu web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanismIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds readIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2022-29458: ncurses: segfaulting OOB readncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.Package Name: libncursesw6 Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u1 References: seclists.org seclists.org access.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.gnu.org lists.gnu.org nvd.nist.gov support.apple.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-29491: ncurses: Local users can trigger security-relevant memory corruption via malformed datancurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.Package Name: libncursesw6 Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u2 References: ncurses.scripts.mit.edu ncurses.scripts.mit.edu www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com support.apple.com support.apple.com support.apple.com ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| HIGH |
CVE-2025-69720: ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.Package Name: libncursesw6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com invisible-island.net invisible-island.net linux.oracle.com linux.oracle.com marc.info marc.info marc.info nvd.nist.gov ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-6020: linux-pam: Linux-pam directory TraversalA flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.Package Name: libpam-modules Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2025-6020: linux-pam: Linux-pam directory TraversalA flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.Package Name: libpam-modules-bin Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2025-6020: linux-pam: Linux-pam directory TraversalA flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.Package Name: libpam-runtime Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2025-6020: linux-pam: Linux-pam directory TraversalA flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.Package Name: libpam0g Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2021-36690: A segmentation fault can occur in the sqlite3.exe command-line compone ...A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: 3.34.1-3+deb11u1 References: seclists.org seclists.org seclists.org seclists.org seclists.org lists.debian.org nvd.nist.gov support.apple.com support.apple.com support.apple.com support.apple.com ubuntu.com www.cve.org www.sqlite.org |
|
| HIGH |
CVE-2023-7104: sqlite: heap-buffer-overflow at sessionfuzzA vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: 3.34.1-3+deb11u1 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com sqlite.org sqlite.org ubuntu.com ubuntu.com vuldb.com vuldb.com www.cve.org |
|
| HIGH |
CVE-2025-6965: sqlite: Integer Truncation in SQLiteThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.oracle.com www.sqlite.org |
|
| HIGH |
CVE-2022-1304: e2fsprogs: out-of-bounds read/write via crafted filesystemAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.Package Name: libss2 Installed Version: 1.46.2-2 Fixed Version: 1.46.2-2+deb11u1 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org marc.info nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2022-4450: openssl: double free after calling PEM_read_bio_exThe function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0215: openssl: use-after-free following BIO_new_NDEFThe public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0286: openssl: X.400 address type confusion in X.509 GeneralNameThere is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org ftp.openbsd.org ftp.openbsd.org git.openssl.org git.openssl.org git.openssl.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0464: openssl: Denial of service by excessive resource usage in verifying X509 policy constraintsA security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.couchbase.com www.couchbase.com www.cve.org www.debian.org www.openssl.org |
|
| HIGH |
CVE-2025-69421: openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processingIssue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-28387: openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authenticationIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28388: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processingIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28389: openssl: OpenSSL: Denial of Service vulnerability in CMS processingIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processingIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-45447: openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org security.access.redhat.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-50387: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validatorCertain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.powerdns.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.suse.com cve.mitre.org cve.mitre.org cve.mitre.org docs.powerdns.com errata.almalinux.org errata.rockylinux.org gitlab.nic.cz kb.isc.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org lists.debian.org lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.thekelleys.org.uk msrc.microsoft.com news.ycombinator.com news.ycombinator.com nlnetlabs.nl nlnetlabs.nl nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.athene-center.de www.athene-center.de www.cve.org www.isc.org www.knot-resolver.cz www.securityweek.com www.theregister.com |
|
| HIGH |
CVE-2023-50868: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resourcesThe Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.powerdns.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.suse.com cve.mitre.org cve.mitre.org cve.mitre.org datatracker.ietf.org docs.powerdns.com errata.almalinux.org errata.rockylinux.org gitlab.nic.cz kb.isc.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org lists.debian.org lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.thekelleys.org.uk nlnetlabs.nl nlnetlabs.nl nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.isc.org www.knot-resolver.cz |
|
| HIGH |
CVE-2022-29458: ncurses: segfaulting OOB readncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.Package Name: libtinfo6 Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u1 References: seclists.org seclists.org access.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.gnu.org lists.gnu.org nvd.nist.gov support.apple.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-29491: ncurses: Local users can trigger security-relevant memory corruption via malformed datancurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.Package Name: libtinfo6 Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u2 References: ncurses.scripts.mit.edu ncurses.scripts.mit.edu www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com support.apple.com support.apple.com support.apple.com ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| HIGH |
CVE-2025-69720: ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.Package Name: libtinfo6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com invisible-island.net invisible-island.net linux.oracle.com linux.oracle.com marc.info marc.info marc.info nvd.nist.gov ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-50387: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validatorCertain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.powerdns.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.suse.com cve.mitre.org cve.mitre.org cve.mitre.org docs.powerdns.com errata.almalinux.org errata.rockylinux.org gitlab.nic.cz kb.isc.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org lists.debian.org lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.thekelleys.org.uk msrc.microsoft.com news.ycombinator.com news.ycombinator.com nlnetlabs.nl nlnetlabs.nl nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.athene-center.de www.athene-center.de www.cve.org www.isc.org www.knot-resolver.cz www.securityweek.com www.theregister.com |
|
| HIGH |
CVE-2023-50868: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resourcesThe Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.powerdns.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.suse.com cve.mitre.org cve.mitre.org cve.mitre.org datatracker.ietf.org docs.powerdns.com errata.almalinux.org errata.rockylinux.org gitlab.nic.cz kb.isc.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org lists.debian.org lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.thekelleys.org.uk nlnetlabs.nl nlnetlabs.nl nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.isc.org www.knot-resolver.cz |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2022-4899: zstd: mysql: buffer overrun in util.cA vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.Package Name: libzstd1 Installed Version: 1.4.8+dfsg-2.1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com security.netapp.com www.cve.org |
|
| HIGH |
CVE-2022-1304: e2fsprogs: out-of-bounds read/write via crafted filesystemAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.Package Name: logsave Installed Version: 1.46.2-2 Fixed Version: 1.46.2-2+deb11u1 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org marc.info nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| HIGH |
CVE-2022-29458: ncurses: segfaulting OOB readncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.Package Name: ncurses-base Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u1 References: seclists.org seclists.org access.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.gnu.org lists.gnu.org nvd.nist.gov support.apple.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-29491: ncurses: Local users can trigger security-relevant memory corruption via malformed datancurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.Package Name: ncurses-base Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u2 References: ncurses.scripts.mit.edu ncurses.scripts.mit.edu www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com support.apple.com support.apple.com support.apple.com ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| HIGH |
CVE-2025-69720: ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.Package Name: ncurses-base Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com invisible-island.net invisible-island.net linux.oracle.com linux.oracle.com marc.info marc.info marc.info nvd.nist.gov ubuntu.com www.cve.org |
|
| HIGH |
CVE-2022-29458: ncurses: segfaulting OOB readncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.Package Name: ncurses-bin Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u1 References: seclists.org seclists.org access.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.gnu.org lists.gnu.org nvd.nist.gov support.apple.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-29491: ncurses: Local users can trigger security-relevant memory corruption via malformed datancurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.Package Name: ncurses-bin Installed Version: 6.2+20201114-2 Fixed Version: 6.2+20201114-2+deb11u2 References: ncurses.scripts.mit.edu ncurses.scripts.mit.edu www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org invisible-island.net linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com support.apple.com support.apple.com support.apple.com ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| HIGH |
CVE-2025-69720: ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.Package Name: ncurses-bin Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com invisible-island.net invisible-island.net linux.oracle.com linux.oracle.com marc.info marc.info marc.info nvd.nist.gov ubuntu.com www.cve.org |
|
| HIGH |
CVE-2022-4450: openssl: double free after calling PEM_read_bio_exThe function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0215: openssl: use-after-free following BIO_new_NDEFThe public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0286: openssl: X.400 address type confusion in X.509 GeneralNameThere is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org ftp.openbsd.org ftp.openbsd.org git.openssl.org git.openssl.org git.openssl.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| HIGH |
CVE-2023-0464: openssl: Denial of service by excessive resource usage in verifying X509 policy constraintsA security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.couchbase.com www.couchbase.com www.cve.org www.debian.org www.openssl.org |
|
| HIGH |
CVE-2025-69421: openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processingIssue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-28387: openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authenticationIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28388: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processingIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28389: openssl: OpenSSL: Denial of Service vulnerability in CMS processingIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processingIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u7 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2026-45447: openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org security.access.redhat.com ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2020-16156: perl-CPAN: Bypass of verification of signatures in CHECKSUMS filesCPAN 2.28 allows Signature Verification Bypass.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: 5.32.1-4+deb11u4 References: blogs.perl.org access.redhat.com access.redhat.com blog.hackeriet.no bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org metacpan.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| HIGH |
CVE-2023-31484: perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPSCPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: 5.32.1-4+deb11u4 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.hackeriet.no bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org metacpan.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| HIGH |
CVE-2023-47038: perl: Write past buffer end via illegal user-defined Unicode propertyA vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: 5.32.1-4+deb11u3 References: access.redhat.com access.redhat.com access.redhat.com bugs.debian.org bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov perldoc.perl.org ubuntu.com ubuntu.com www.cve.org www.suse.com |
|
| HIGH |
CVE-2026-42497: perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extractionArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: access.redhat.com github.com metacpan.org nvd.nist.gov www.cve.org www.cve.org |
|
| HIGH |
CVE-2026-48962: perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output globIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com metacpan.org nvd.nist.gov security.access.redhat.com www.cve.org |
|
| HIGH |
CVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measure_st ...Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com github.com github.com |
|
| HIGH |
CVE-2026-9538: perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry sizeArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com metacpan.org nvd.nist.gov www.cve.org |
|
| HIGH |
CVE-2026-53615: [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.cPackage Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2025-30258: gnupg: verification DoS due to a malicious subkey in the keyringIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."Package Name: gpgv Installed Version: 2.2.27-2+deb11u2 Fixed Version: References: access.redhat.com dev.gnupg.org dev.gnupg.org lists.gnupg.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-68972: gnupg: GnuPG: Signature bypass via form feed character in signed messagesIn GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.Package Name: gpgv Installed Version: 2.2.27-2+deb11u2 Fixed Version: References: access.redhat.com github.com gpg.fail media.ccc.de news.ycombinator.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-41991: gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utilityGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269Package Name: gzip Installed Version: 1.10-4+deb11u1 Fixed Version: References: access.redhat.com cert.pl cgit.git.savannah.gnu.org nvd.nist.gov ubuntu.com www.cve.org www.gnu.org |
|
| MEDIUM |
CVE-2026-54370: acl: TOCTOU Symlink Traversal via getfacl/setfaclacl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.Package Name: libacl1 Installed Version: 2.2.53-10 Fixed Version: References: access.redhat.com cgit.git.savannah.nongnu.org cgit.git.savannah.nongnu.org nvd.nist.gov www.cve.org www.vulncheck.com |
|
| MEDIUM |
CVE-2026-54371: attr: Symlink Traversal Privilege Escalation via getfattr and setfattrattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.Package Name: libattr1 Installed Version: 1:2.4.48-6 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com cgit.git.savannah.nongnu.org cgit.git.savannah.nongnu.org nvd.nist.gov security.access.redhat.com www.cve.org www.vulncheck.com |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-42250: bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted filebzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67Package Name: libbz2-1.0 Installed Version: 1.0.8-4 Fixed Version: References: access.redhat.com cert.pl inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2023-4806: glibc: potential use-after-free in getaddrinfo()A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: cve.mitre.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-4813: glibc: potential use-after-free in gaih_inet()A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2024-33600: glibc: null pointer dereferences after failed netgroup cache insertionnscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2025-0395: glibc: buffer overflow in the GNU C Library's assert()When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u12 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org sourceware.org sourceware.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2025-4802: glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATHUntrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u13 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| MEDIUM |
CVE-2025-8058: glibc: Double free in glibcThe regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-0915: glibc: glibc: Information disclosure via zero-valued network queryCalling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processingThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large widthCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodingsCalling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-6238: glibc: glibc: Application crash or uninitialized memory read via crafted DNS responseThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2023-4806: glibc: potential use-after-free in getaddrinfo()A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: cve.mitre.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-4813: glibc: potential use-after-free in gaih_inet()A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2024-33600: glibc: null pointer dereferences after failed netgroup cache insertionnscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2025-0395: glibc: buffer overflow in the GNU C Library's assert()When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u12 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org sourceware.org sourceware.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2025-4802: glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATHUntrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u13 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com www.cve.org www.openwall.com www.openwall.com |
|
| MEDIUM |
CVE-2025-8058: glibc: Double free in glibcThe regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-0915: glibc: glibc: Information disclosure via zero-valued network queryCalling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processingThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large widthCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodingsCalling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-6238: glibc: glibc: Application crash or uninitialized memory read via crafted DNS responseThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2024-50602: libexpat: expat: DoS via XML_ResumeParserAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: 2.2.10-2+deb11u7 References: cve.mitre.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org docs.python.org docs.python.org docs.python.org docs.python.org docs.python.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2024-8176: libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpatA stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: cve.mitre.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com blog.hartwork.org bugzilla.redhat.com bugzilla.redhat.com bugzilla.suse.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com gitlab.alpinelinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security-tracker.debian.org security.netapp.com ubuntu.com ubuntu.com www.cve.org www.kb.cert.org |
|
| MEDIUM |
CVE-2025-66382: libexpat: libexpat: Denial of service via crafted file processingIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-32776: libexpat: libexpat: Denial of Service due to NULL pointer dereferencelibexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-32777: libexpat: libexpat: Denial of Service via infinite loop in DTD content parsinglibexpat before 2.7.5 allows an infinite loop while parsing DTD content.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com github.com issues.oss-fuzz.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-32778: libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory conditionlibexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-50219: expat: libexpat: Use-after-free vulnerability due to improper handler call depth trackinglibexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56132: expat: libexpat: Arbitrary Code Execution via Heap-based Buffer OverflowIn libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56403: libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAttslibexpat before 2.8.2 has an integer overflow in storeAtts.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56404: libexpat before 2.8.2 has an integer overflow in addBinding.libexpat before 2.8.2 has an integer overflow in addBinding.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: github.com nvd.nist.gov |
|
| MEDIUM |
CVE-2026-56405: libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflowlibexpat before 2.8.2 has an integer overflow in getAttributeId.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56406: libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBufferlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56409: xmlwf in libexpat before 2.8.2 has an integer overflow for the output ...xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: github.com nvd.nist.gov |
|
| MEDIUM |
CVE-2026-56410: libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56411: expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Executionxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-56412: libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sectionslibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2023-5981: gnutls: timing side-channel in the RSA-PSK authenticationA vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u4 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gnutls.org linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.gnupg.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2024-12243: gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoSA flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u7 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gitlab.com linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2024-28834: gnutls: vulnerable to Minerva side-channel information leakA flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org minerva.crocs.fi.muni.cz nvd.nist.gov people.redhat.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2024-28835: gnutls: potential crash during chain building/verificationA flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u6 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2025-14831: gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verificationA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u9 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-6395: gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite()A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u8 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com linux.oracle.com linux.oracle.com lists.debian.org lists.gnupg.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-42011: gnutls: gnutls: Security bypass due to incorrect name constraint handlingA flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2026-42012: gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANsA flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2026-42013: gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative NameA flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2026-42014: gnutls: gnutls: Use-after-free in gnutls_pkcs11_token_set_pinA flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2026-42015: gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handlingA flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2026-5260: gnutls: gnutls: Information disclosure via heap overread in RSA key exchangeA flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u10 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| MEDIUM |
CVE-2023-36054: krb5: Denial of service through freeing uninitialized pointerlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2025-24528: krb5: overflow when calculating ulog block sizeIn MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-3576: krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 CollisionsA vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u7 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2023-36054: krb5: Denial of service through freeing uninitialized pointerlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2025-24528: krb5: overflow when calculating ulog block sizeIn MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-3576: krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 CollisionsA vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u7 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2023-36054: krb5: Denial of service through freeing uninitialized pointerlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2025-24528: krb5: overflow when calculating ulog block sizeIn MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-3576: krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 CollisionsA vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u7 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2023-36054: krb5: Denial of service through freeing uninitialized pointerlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2025-24528: krb5: overflow when calculating ulog block sizeIn MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-3576: krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 CollisionsA vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: 1.18.3-6+deb11u7 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com web.mit.edu www.cve.org |
|
| MEDIUM |
CVE-2026-34743: xz: XZ Utils: Denial of Service via buffer overflow in index decodingXZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.Package Name: liblzma5 Installed Version: 5.2.5-2.1~deb11u1 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com github.com nvd.nist.gov tukaani.org ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry()NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().Package Name: libncursesw6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-13757: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsingA flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.Package Name: libp11-kit0 Installed Version: 0.23.22-1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed passwordA vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.Package Name: libpam-modules Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-22365: pam: allowing unprivileged user to block another user namespacelinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.Package Name: libpam-modules Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-54411: linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb moduleLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.Package Name: libpam-modules Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com cwe.mitre.org github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed passwordA vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.Package Name: libpam-modules-bin Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-22365: pam: allowing unprivileged user to block another user namespacelinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.Package Name: libpam-modules-bin Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-54411: linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb moduleLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.Package Name: libpam-modules-bin Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com cwe.mitre.org github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed passwordA vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.Package Name: libpam-runtime Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-22365: pam: allowing unprivileged user to block another user namespacelinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.Package Name: libpam-runtime Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-54411: linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb moduleLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.Package Name: libpam-runtime Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com cwe.mitre.org github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-10041: pam: libpam: Libpam vulnerable to read hashed passwordA vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.Package Name: libpam0g Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-22365: pam: allowing unprivileged user to block another user namespacelinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.Package Name: libpam0g Installed Version: 1.4.0-9+deb11u1 Fixed Version: 1.4.0-9+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-54411: linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb moduleLinux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.Package Name: libpam0g Installed Version: 1.4.0-9+deb11u1 Fixed Version: References: access.redhat.com cwe.mitre.org github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-11822: SQLite before 3.53.2 contains memory corruption vulnerabilities in the ...SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: nvd.nist.gov sqlite.org sqlite.org sqlite.org ubuntu.com www.cve.org www.vulncheck.com |
|
| MEDIUM |
CVE-2026-11824: SQLite before 3.53.2 contains a heap-based buffer overflow vulnerabili ...SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: nvd.nist.gov sqlite.org sqlite.org sqlite.org ubuntu.com www.cve.org www.vulncheck.com |
|
| MEDIUM |
CVE-2022-2097: openssl: AES OCB fails to encrypt some bytesAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov rustsec.org security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2022-4304: openssl: timing attack in RSA Decryption implementationA timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-0465: openssl: Invalid certificate policies in leaf certificates are silently ignoredApplications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-0466: openssl: Certificate policy check not enabledThe function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-2650: openssl: Possible DoS translating ASN.1 object identifiersIssue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov psirt.global.sonicwall.com security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-3446: openssl: Excessive time spent checking DH keys and parametersIssue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1v-0~deb11u1 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-3817: OpenSSL: Excessive time spent checking DH q parameter valueIssue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1v-0~deb11u1 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-5678: openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slowIssue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2024-0727: openssl: denial of service via null dereferenceIssue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2025-69419: openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processingIssue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-9230: openssl: Out-of-bounds read & write in RFC 3211 KEK UnwrapIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u4 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2022-3821: systemd: buffer overrun in format_timespan() functionAn off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2022-4415: systemd: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel settingA vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u2 References: seclists.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yesA vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: cve.mitre.org access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-4598: systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dumpA vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u7 References: seclists.org www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com blogs.oracle.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com ciq.com cve.mitre.org errata.almalinux.org errata.rockylinux.org git.kernel.org github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com www.openwall.com www.qualys.com |
|
| MEDIUM |
CVE-2026-29111: systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call datasystemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-40225: systemd: udev in systemd: Privilege escalation via malicious hardware devices and unsanitized kernel outputIn udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-40226: systemd: systemd nspawn: Escape-to-host action via crafted config fileIn nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com github.com nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-4105: systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus methodA flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2024-12133: libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoSA flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.Package Name: libtasn1-6 Installed Version: 4.16.0-2 Fixed Version: 4.16.0-2+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gitlab.com gitlab.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry()NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().Package Name: libtinfo6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2022-3821: systemd: buffer overrun in format_timespan() functionAn off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.gentoo.org ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2022-4415: systemd: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel settingA vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u2 References: seclists.org access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yesA vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u6 References: cve.mitre.org access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-4598: systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dumpA vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u7 References: seclists.org www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com blogs.oracle.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com ciq.com cve.mitre.org errata.almalinux.org errata.rockylinux.org git.kernel.org github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org www.openwall.com www.openwall.com www.qualys.com |
|
| MEDIUM |
CVE-2026-29111: systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call datasystemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-40225: systemd: udev in systemd: Privilege escalation via malicious hardware devices and unsanitized kernel outputIn udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-40226: systemd: systemd nspawn: Escape-to-host action via crafted config fileIn nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com github.com nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-4105: systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus methodA flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: 247.3-7+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2023-4641: shadow-utils: possible password leak during passwd(1) changeA flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.Package Name: login Installed Version: 1:4.8.1-1 Fixed Version: 1:4.8.1-1+deb11u1 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry()NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().Package Name: ncurses-base Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry()NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().Package Name: ncurses-bin Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2022-2097: openssl: AES OCB fails to encrypt some bytesAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov rustsec.org security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2022-4304: openssl: timing attack in RSA Decryption implementationA timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov psirt.global.sonicwall.com rustsec.org security.gentoo.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-0465: openssl: Invalid certificate policies in leaf certificates are silently ignoredApplications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-0466: openssl: Certificate policy check not enabledThe function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-2650: openssl: Possible DoS translating ASN.1 object identifiersIssue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1n-0+deb11u5 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov psirt.global.sonicwall.com security.gentoo.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.debian.org www.openssl.org |
|
| MEDIUM |
CVE-2023-3446: openssl: Excessive time spent checking DH keys and parametersIssue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1v-0~deb11u1 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-3817: OpenSSL: Excessive time spent checking DH q parameter valueIssue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1v-0~deb11u1 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.gentoo.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2023-5678: openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slowIssue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.openssl.org git.openssl.org git.openssl.org git.openssl.org github.com linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2024-0727: openssl: denial of service via null dereferenceIssue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| MEDIUM |
CVE-2025-69419: openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processingIssue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-9230: openssl: Out-of-bounds read & write in RFC 3211 KEK UnwrapIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u4 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-4641: shadow-utils: possible password leak during passwd(1) changeA flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.Package Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: 1:4.8.1-1+deb11u1 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2025-15649: perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip headerIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com metacpan.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2025-40909: perl: Perl threads have a working directory race condition where file operations may target unintended pathsPerl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: 5.32.1-4+deb11u5 References: seclists.org seclists.org seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugs.debian.org bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.security.metacpan.org nvd.nist.gov perldoc.perl.org ubuntu.com www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-12087: perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds ReadSocket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com metacpan.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-48959: perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForwardIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com metacpan.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-48961: perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra FieldIO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com access.redhat.com github.com metacpan.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-7010: HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com github.com metacpan.org |
|
| MEDIUM |
CVE-2026-5958: sed: GNU sed TOCTOU race conditionWhen sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process. This issue was fixed in version 4.10.Package Name: sed Installed Version: 4.7-1 Fixed Version: References: www.openwall.com access.redhat.com cert.pl github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnu.org www.gnu.org |
|
| MEDIUM |
CVE-2026-5704: tar: tar: Hidden file injection via crafted archivesA flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.Package Name: tar Installed Version: 1.34+dfsg-1 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2026-13595: util-linux: util-linux: heap use-after-free in libblkid nested partition probingA flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27456: util-linux: TOCTOU in the mount program when setting up loop devicesutil-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-3184: util-linux: util-linux: Access control bypass due to improper hostname canonicalizationA flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-27171: zlib: zlib: Denial of Service via infinite loop in CRC32 combine functionszlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.Package Name: zlib1g Installed Version: 1:1.2.11.dfsg-2+deb11u2 Fixed Version: References: 7asecurity.com 7asecurity.com 7asecurity.com access.redhat.com github.com github.com github.com nvd.nist.gov ostif.org ostif.org www.cve.org |
|
| LOW |
CVE-2011-3374: It was found that apt-key in apt, all versions, do not correctly valid ...It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.Package Name: apt Installed Version: 2.2.4 Fixed Version: References: access.redhat.com bugs.debian.org people.canonical.com seclists.org security-tracker.debian.org snyk.io ubuntu.com |
|
| LOW |
TEMP-0841856-B18BAF: [Privilege escalation possible to other user than root]Package Name: bash Installed Version: 5.1-2+deb11u1 Fixed Version: References: |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2016-2781: coreutils: Non-privileged session can escape to the parent session in chrootchroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.Package Name: coreutils Installed Version: 8.32-4+b1 Fixed Version: References: www.openwall.com www.openwall.com access.redhat.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2017-18018: coreutils: race condition vulnerability in chown and chgrpIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.Package Name: coreutils Installed Version: 8.32-4+b1 Fixed Version: References: lists.gnu.org access.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key SpecificationA flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.Package Name: coreutils Installed Version: 8.32-4+b1 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cgit.git.savannah.gnu.org cgit.git.savannah.gnu.org cve.mitre.org debbugs.gnu.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov security-tracker.debian.org www.cve.org |
|
| LOW |
CVE-2025-6297: It was discovered that dpkg-deb does not properly sanitize directory p ...It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.Package Name: dpkg Installed Version: 1.20.12 Fixed Version: 1.20.14 References: git.dpkg.org lists.debian.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-4039: gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.Package Name: gcc-10-base Installed Version: 10.2.1-6 Fixed Version: References: access.redhat.com developer.arm.com gcc.gnu.org gcc.gnu.org github.com inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov rtx.meta.security ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-4039: gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.Package Name: gcc-9-base Installed Version: 9.3.0-22 Fixed Version: References: access.redhat.com developer.arm.com gcc.gnu.org gcc.gnu.org github.com inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov rtx.meta.security ubuntu.com www.cve.org |
|
| LOW |
CVE-2022-3219: gnupg: denial of service issue (resource consumption) using compressed packetsGnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.Package Name: gpgv Installed Version: 2.2.27-2+deb11u2 Fixed Version: References: access.redhat.com bugzilla.redhat.com dev.gnupg.org dev.gnupg.org marc.info nvd.nist.gov security.netapp.com www.cve.org |
|
| LOW |
CVE-2011-3374: It was found that apt-key in apt, all versions, do not correctly valid ...It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.Package Name: libapt-pkg6.0 Installed Version: 2.2.4 Fixed Version: References: access.redhat.com bugs.debian.org people.canonical.com seclists.org security-tracker.debian.org snyk.io ubuntu.com |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2010-4756: glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressionsThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: cxib.net securityreason.com securityreason.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com nvd.nist.gov security.netapp.com www.cve.org |
|
| LOW |
CVE-2018-20796: glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.cIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com debbugs.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com support.f5.com www.cve.org |
|
| LOW |
CVE-2019-1010022: glibc: stack guard protection bypassGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org sourceware.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010023: glibc: running ldd on malicious ELF leads to code execution because of wrong size computationGNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010024: glibc: ASLR bypass using cache of thread stack and heapGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010025: glibc: information disclosure of heap addresses of pthread_created threadGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-9192: glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.cIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted patternPackage Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org support.f5.com www.cve.org |
|
| LOW |
CVE-2024-33601: glibc: netgroup cache may terminate daemon on memory allocation failurenscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2024-33602: glibc: netgroup cache assumes NSS callback uses in-buffer stringsnscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-15281: glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memoryCalling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: cve.mitre.org www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2026-0861: glibc: Integer overflow in memalign leads to heap corruptionPassing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.Package Name: libc-bin Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org sourceware.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2010-4756: glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressionsThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: cxib.net securityreason.com securityreason.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com nvd.nist.gov security.netapp.com www.cve.org |
|
| LOW |
CVE-2018-20796: glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.cIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com debbugs.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com support.f5.com www.cve.org |
|
| LOW |
CVE-2019-1010022: glibc: stack guard protection bypassGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org sourceware.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010023: glibc: running ldd on malicious ELF leads to code execution because of wrong size computationGNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010024: glibc: ASLR bypass using cache of thread stack and heapGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: www.securityfocus.com access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-1010025: glibc: information disclosure of heap addresses of pthread_created threadGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov security-tracker.debian.org sourceware.org support.f5.com support.f5.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2019-9192: glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.cIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted patternPackage Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org support.f5.com www.cve.org |
|
| LOW |
CVE-2024-33601: glibc: netgroup cache may terminate daemon on memory allocation failurenscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2024-33602: glibc: netgroup cache assumes NSS callback uses in-buffer stringsnscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u10 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov security.netapp.com sourceware.org sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-15281: glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memoryCalling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: cve.mitre.org www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2026-0861: glibc: Integer overflow in memalign leads to heap corruptionPassing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.Package Name: libc6 Installed Version: 2.31-13+deb11u5 Fixed Version: 2.31-13+deb11u14 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov sourceware.org sourceware.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2013-0340: expat: internal entity expansionexpat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: openwall.com seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org securitytracker.com www.openwall.com www.openwall.com www.osvdb.org www.securityfocus.com access.redhat.com github.com lists.apache.org lists.apache.org nvd.nist.gov security.gentoo.org support.apple.com support.apple.com support.apple.com support.apple.com support.apple.com support.apple.com www.cve.org |
|
| LOW |
CVE-2023-52426: expat: recursive XML entity expansion vulnerabilitylibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: cve.mitre.org access.redhat.com cwe.mitre.org github.com github.com github.com lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28757: expat: XML Entity Expansionlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: cve.mitre.org www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com errata.almalinux.org github.com github.com github.com linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-24515: libexpat: libexpat null pointer dereferenceIn libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com nvd.nist.gov ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-41080: libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XMLlibexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.Package Name: libexpat1 Installed Version: 2.2.10-2+deb11u5 Fixed Version: References: www.openwall.com access.redhat.com blog.hartwork.org cert-portal.siemens.com github.com github.com nvd.nist.gov www.cve.org www.openwall.com |
|
| LOW |
CVE-2023-4039: gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.Package Name: libgcc-s1 Installed Version: 10.2.1-6 Fixed Version: References: access.redhat.com developer.arm.com gcc.gnu.org gcc.gnu.org github.com inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov rtx.meta.security ubuntu.com www.cve.org |
|
| LOW |
CVE-2018-6829: libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing to obtain sensitive informationcipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.Package Name: libgcrypt20 Installed Version: 1.8.7-6 Fixed Version: References: access.redhat.com github.com github.com lists.gnupg.org nvd.nist.gov www.cve.org www.oracle.com |
|
| LOW |
CVE-2024-2236: libgcrypt: vulnerable to Marvin AttackA timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.Package Name: libgcrypt20 Installed Version: 1.8.7-6 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org dev.gnupg.org errata.almalinux.org errata.rockylinux.org github.com gitlab.com linux.oracle.com linux.oracle.com lists.gnupg.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: References: arcticdog.wordpress.com blog.mozilla.com blogs.technet.com blogs.technet.com curl.haxx.se downloads.asterisk.org ekoparty.org eprint.iacr.org eprint.iacr.org googlechromereleases.blogspot.com isc.sans.edu lists.apple.com lists.apple.com lists.apple.com lists.apple.com lists.apple.com lists.apple.com lists.apple.com lists.opensuse.org lists.opensuse.org lists.opensuse.org lists.opensuse.org marc.info marc.info marc.info marc.info marc.info marc.info my.opera.com osvdb.org rhn.redhat.com rhn.redhat.com secunia.com secunia.com secunia.com secunia.com secunia.com secunia.com secunia.com secunia.com secunia.com secunia.com security.gentoo.org security.gentoo.org support.apple.com support.apple.com support.apple.com support.apple.com support.apple.com support.apple.com technet.microsoft.com vnhacker.blogspot.com www.apcmedia.com www.debian.org www.educatedguesswork.org www.ibm.com www.imperialviolet.org www.insecure.cl www.kb.cert.org www.mandriva.com www.opera.com www.opera.com www.opera.com www.opera.com www.opera.com www.opera.com www.opera.com www.oracle.com www.oracle.com www.oracle.com www.redhat.com www.redhat.com www.securityfocus.com www.securityfocus.com www.securitytracker.com www.securitytracker.com www.securitytracker.com www.securitytracker.com www.ubuntu.com www.us-cert.gov access.redhat.com blogs.oracle.com bugzilla.novell.com bugzilla.redhat.com cert-portal.siemens.com docs.microsoft.com h20564.www2.hp.com hermes.opensuse.org hermes.opensuse.org ics-cert.us-cert.gov linux.oracle.com linux.oracle.com nvd.nist.gov oval.cisecurity.org ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-9820: gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() FunctionA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.Package Name: libgnutls30 Installed Version: 3.7.1-5+deb11u2 Fixed Version: 3.7.1-5+deb11u9 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gitlab.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnutls.org |
|
| LOW |
CVE-2018-5709: krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.cAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com github.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-26458: krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2024-26461: krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-11850: krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readAn integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.Package Name: libgssapi-krb5-2 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2018-5709: krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.cAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com github.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-26458: krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2024-26461: krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-11850: krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readAn integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.Package Name: libk5crypto3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2018-5709: krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.cAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com github.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-26458: krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2024-26461: krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-11850: krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readAn integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.Package Name: libkrb5-3 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2018-5709: krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.cAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com github.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2024-26458: krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2024-26461: krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.cKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com mailman.mit.edu nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-11850: krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readAn integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.Package Name: libkrb5support0 Installed Version: 1.18.3-6+deb11u3 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2025-6141: gnu-ncurses: ncurses Stack Buffer OverflowA vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.Package Name: libncursesw6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com invisible-island.net lists.gnu.org lists.gnu.org lists.gnu.org nvd.nist.gov vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org www.gnu.org |
|
| LOW |
CVE-2022-41409: pcre2: negative repeat value in a pcre2test subject line leads to inifinite loopInteger overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.Package Name: libpcre2-8-0 Installed Version: 10.36-2+deb11u1 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2017-11164: pcre: OP_KETRMAX feature in the match function in pcre_exec.cIn PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.Package Name: libpcre3 Installed Version: 2:8.39-13 Fixed Version: References: openwall.com www.openwall.com www.openwall.com www.securityfocus.com access.redhat.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2017-16231: pcre: self-recursive call in match() in pcre_exec.c leads to denial of serviceIn PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is usedPackage Name: libpcre3 Installed Version: 2:8.39-13 Fixed Version: References: packetstormsecurity.com seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.securityfocus.com access.redhat.com bugs.exim.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2017-7245: pcre: stack-based buffer overflow write in pcre32_copy_substringStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.Package Name: libpcre3 Installed Version: 2:8.39-13 Fixed Version: References: www.securityfocus.com access.redhat.com access.redhat.com blogs.gentoo.org nvd.nist.gov security.gentoo.org www.cve.org |
|
| LOW |
CVE-2017-7246: pcre: stack-based buffer overflow write in pcre32_copy_substringStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.Package Name: libpcre3 Installed Version: 2:8.39-13 Fixed Version: References: www.securityfocus.com access.redhat.com access.redhat.com blogs.gentoo.org nvd.nist.gov security.gentoo.org www.cve.org |
|
| LOW |
CVE-2019-20838: pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.Package Name: libpcre3 Installed Version: 2:8.39-13 Fixed Version: References: seclists.org seclists.org access.redhat.com bugs.gentoo.org bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.apache.org nvd.nist.gov support.apple.com support.apple.com ubuntu.com www.cve.org www.pcre.org |
|
| LOW |
CVE-2021-36084: libsepol: use-after-free in __cil_verify_classperms()The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).Package Name: libsepol1 Installed Version: 3.1-1 Fixed Version: 3.1-1+deb11u1 References: access.redhat.com bugs.chromium.org bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2021-36085: libsepol: use-after-free in __cil_verify_classperms()The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).Package Name: libsepol1 Installed Version: 3.1-1 Fixed Version: 3.1-1+deb11u1 References: access.redhat.com bugs.chromium.org bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2021-36086: libsepol: use-after-free in cil_reset_classpermission()The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).Package Name: libsepol1 Installed Version: 3.1-1 Fixed Version: 3.1-1+deb11u1 References: access.redhat.com bugs.chromium.org bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2021-36087: libsepol: heap-based buffer overflow in ebitmap_match_any()The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.Package Name: libsepol1 Installed Version: 3.1-1 Fixed Version: 3.1-1+deb11u1 References: access.redhat.com bugs.chromium.org bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lore.kernel.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2021-45346: sqlite: crafted SQL query allows a malicious user to obtain sensitive informationA Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: access.redhat.com github.com nvd.nist.gov security.netapp.com sqlite.org sqlite.org www.cve.org www.sqlite.org |
|
| LOW |
CVE-2022-35737: sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C APISQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: access.redhat.com access.redhat.com blog.trailofbits.com blog.trailofbits.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com kb.cert.org linux.oracle.com linux.oracle.com nvd.nist.gov rustsec.org security.gentoo.org security.netapp.com security.netapp.com sqlite.org ubuntu.com ubuntu.com ubuntu.com www.cve.org www.sqlite.org www.sqlite.org |
|
| LOW |
CVE-2025-29088: sqlite: Denial of Service in SQLiteIn SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: access.redhat.com gist.github.com github.com nvd.nist.gov sqlite.org sqlite.org ubuntu.com ubuntu.com www.cve.org www.sqlite.org |
|
| LOW |
CVE-2025-70873: sqlite: SQLite: Information Disclosure via Crafted ZIP FileAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: access.redhat.com gist.github.com nvd.nist.gov sqlite.org sqlite.org www.cve.org |
|
| LOW |
CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computationIssue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u3 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com |
|
| LOW |
CVE-2024-2511: openssl: Unbounded memory growth with session handling in TLSv1.3Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org www.openssl.org |
|
| LOW |
CVE-2024-4741: openssl: Use After Free with SSL_free_buffersIssue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| LOW |
CVE-2024-5535: openssl: SSL_select_next_proto buffer overreadIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov openssl.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org www.oracle.com |
|
| LOW |
CVE-2024-9143: openssl: Low-level invalid GF(2^m) parameters lead to OOB memory accessIssue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org lists.debian.org lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-27587: OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: References: github.com minerva.crocs.fi.muni.cz |
|
| LOW |
CVE-2025-68160: openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filterIssue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-69418: openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption callsIssue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-69420: openssl: OpenSSL: Denial of Service via malformed TimeStamp ResponseIssue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-22795: openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processingIssue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-22796: openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verificationIssue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-34180: openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-42766: openssl: Possible NULL Dereference in Password-Based CMS DecryptionIssue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-7383: openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizingIssue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-9076: openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryptionIssue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.Package Name: libssl1.1 Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-4039: gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.Package Name: libstdc++6 Installed Version: 10.2.1-6 Fixed Version: References: access.redhat.com developer.arm.com gcc.gnu.org gcc.gnu.org github.com inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov rtx.meta.security ubuntu.com www.cve.org |
|
| LOW |
CVE-2013-4392: systemd: TOCTOU race condition when updating file permissions and SELinux security contextssystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: bugs.debian.org www.openwall.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2020-13529: systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfiguredAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com talosintelligence.com ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-31437: An issue was discovered in systemd 253. An attacker can modify a seale ...An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: github.com github.com github.com |
|
| LOW |
CVE-2023-31438: An issue was discovered in systemd 253. An attacker can truncate a sea ...An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: github.com github.com github.com github.com |
|
| LOW |
CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the con ...An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: cve.mitre.org github.com github.com github.com github.com github.com |
|
| LOW |
CVE-2026-40228: systemd: systemd-journald: Unintended output to user terminals via logger commandIn systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.Package Name: libsystemd0 Installed Version: 247.3-7+deb11u1 Fixed Version: References: www.openwall.com access.redhat.com nvd.nist.gov www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-13151: libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_stringStack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.Package Name: libtasn1-6 Installed Version: 4.16.0-2 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org gitlab.com gitlab.com linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.kb.cert.org |
|
| LOW |
CVE-2025-6141: gnu-ncurses: ncurses Stack Buffer OverflowA vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.Package Name: libtinfo6 Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com invisible-island.net lists.gnu.org lists.gnu.org lists.gnu.org nvd.nist.gov vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org www.gnu.org |
|
| LOW |
CVE-2013-4392: systemd: TOCTOU race condition when updating file permissions and SELinux security contextssystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: bugs.debian.org www.openwall.com access.redhat.com bugzilla.redhat.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2020-13529: systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfiguredAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.fedoraproject.org nvd.nist.gov security.gentoo.org security.netapp.com talosintelligence.com ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-31437: An issue was discovered in systemd 253. An attacker can modify a seale ...An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: github.com github.com github.com |
|
| LOW |
CVE-2023-31438: An issue was discovered in systemd 253. An attacker can truncate a sea ...An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: github.com github.com github.com github.com |
|
| LOW |
CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the con ...An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: cve.mitre.org github.com github.com github.com github.com github.com |
|
| LOW |
CVE-2026-40228: systemd: systemd-journald: Unintended output to user terminals via logger commandIn systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.Package Name: libudev1 Installed Version: 247.3-7+deb11u1 Fixed Version: References: www.openwall.com access.redhat.com nvd.nist.gov www.cve.org www.openwall.com |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2007-5686: initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.Package Name: login Installed Version: 1:4.8.1-1 Fixed Version: References: secunia.com www.securityfocus.com www.securityfocus.com www.securityfocus.com www.vupen.com issues.rpath.com |
|
| LOW |
CVE-2013-4235: shadow-utils: TOCTOU race conditions by copying and removing directory treesshadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory treesPackage Name: login Installed Version: 1:4.8.1-1 Fixed Version: References: access.redhat.com access.redhat.com bugs.launchpad.net bugzilla.redhat.com github.com github.com lists.apache.org nvd.nist.gov security-tracker.debian.org security.gentoo.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-29383: shadow: Improper input validation in shadow-utils package utility chfnIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.Package Name: login Installed Version: 1:4.8.1-1 Fixed Version: 1:4.8.1-1+deb11u1 References: access.redhat.com github.com github.com lists.debian.org nvd.nist.gov www.cve.org www.trustwave.com www.trustwave.com |
|
| LOW |
CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromiseshadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.Package Name: login Installed Version: 1:4.8.1-1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
TEMP-0628843-DBAD28: [more related to CVE-2005-4890]Package Name: login Installed Version: 1:4.8.1-1 Fixed Version: References: |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2025-6141: gnu-ncurses: ncurses Stack Buffer OverflowA vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.Package Name: ncurses-base Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com invisible-island.net lists.gnu.org lists.gnu.org lists.gnu.org nvd.nist.gov vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org www.gnu.org |
|
| LOW |
CVE-2025-6141: gnu-ncurses: ncurses Stack Buffer OverflowA vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.Package Name: ncurses-bin Installed Version: 6.2+20201114-2 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com invisible-island.net lists.gnu.org lists.gnu.org lists.gnu.org nvd.nist.gov vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org www.gnu.org |
|
| LOW |
CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computationIssue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u3 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com |
|
| LOW |
CVE-2024-2511: openssl: Unbounded memory growth with session handling in TLSv1.3Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org www.openssl.org |
|
| LOW |
CVE-2024-4741: openssl: Use After Free with SSL_free_buffersIssue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org |
|
| LOW |
CVE-2024-5535: openssl: SSL_select_next_proto buffer overreadIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org lists.debian.org nvd.nist.gov openssl.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openssl.org www.oracle.com |
|
| LOW |
CVE-2024-9143: openssl: Low-level invalid GF(2^m) parameters lead to OOB memory accessIssue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u2 References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org lists.debian.org lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-27587: OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: References: github.com minerva.crocs.fi.muni.cz |
|
| LOW |
CVE-2025-68160: openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filterIssue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-69418: openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption callsIssue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2025-69420: openssl: OpenSSL: Denial of Service via malformed TimeStamp ResponseIssue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-22795: openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processingIssue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-22796: openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verificationIssue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u5 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-34180: openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-42766: openssl: Possible NULL Dereference in Password-Based CMS DecryptionIssue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-7383: openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizingIssue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2026-9076: openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryptionIssue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.Package Name: openssl Installed Version: 1.1.1n-0+deb11u3 Fixed Version: 1.1.1w-0+deb11u8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2007-5686: initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.Package Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: References: secunia.com www.securityfocus.com www.securityfocus.com www.securityfocus.com www.vupen.com issues.rpath.com |
|
| LOW |
CVE-2013-4235: shadow-utils: TOCTOU race conditions by copying and removing directory treesshadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory treesPackage Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: References: access.redhat.com access.redhat.com bugs.launchpad.net bugzilla.redhat.com github.com github.com lists.apache.org nvd.nist.gov security-tracker.debian.org security.gentoo.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-29383: shadow: Improper input validation in shadow-utils package utility chfnIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.Package Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: 1:4.8.1-1+deb11u1 References: access.redhat.com github.com github.com lists.debian.org nvd.nist.gov www.cve.org www.trustwave.com www.trustwave.com |
|
| LOW |
CVE-2024-56433: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromiseshadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.Package Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| LOW |
TEMP-0628843-DBAD28: [more related to CVE-2005-4890]Package Name: passwd Installed Version: 1:4.8.1-1 Fixed Version: References: |
|
| LOW |
CVE-2011-4116: perl: File:: Temp insecure temporary file handling_is_safe in the File::Temp module for Perl does not properly handle symlinks.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com www.openwall.com access.redhat.com github.com nvd.nist.gov rt.cpan.org seclists.org www.cve.org |
|
| LOW |
CVE-2023-31486: http-tiny: perl: insecure TLS cert defaultHTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com blog.hackeriet.no bugzilla.redhat.com errata.almalinux.org github.com hackeriet.github.io linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com www.cve.org www.openwall.com www.openwall.com www.reddit.com |
|
| LOW |
TEMP-0517018-A83CE6: [sysvinit: no-root option in expert installer exposes locally exploitable security flaw]Package Name: sysvinit-utils Installed Version: 2.96-7+deb11u1 Fixed Version: References: |
|
| LOW |
CVE-2005-2541: tar: does not properly warn the user when extracting setuid or setgid filesTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.Package Name: tar Installed Version: 1.34+dfsg-1 Fixed Version: References: marc.info access.redhat.com lists.apache.org nvd.nist.gov www.cve.org |
|
| LOW |
CVE-2022-48303: tar: heap buffer overflow at from_header() in list.c via specially crafted checksumGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.Package Name: tar Installed Version: 1.34+dfsg-1 Fixed Version: 1.34+dfsg-1+deb11u1 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov savannah.gnu.org savannah.gnu.org ubuntu.com ubuntu.com www.cve.org |
|
| LOW |
CVE-2023-39804: tar: Incorrectly handled extension attributes in PAX archives can lead to a crashIn GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.Package Name: tar Installed Version: 1.34+dfsg-1 Fixed Version: 1.34+dfsg-1+deb11u1 References: access.redhat.com bugs.debian.org git.savannah.gnu.org git.savannah.gnu.org lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| LOW |
TEMP-0290435-0B57B5: [tar's rmt command may have undesired side effects]Package Name: tar Installed Version: 1.34+dfsg-1 Fixed Version: References: |
|
| LOW |
CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadlineA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: cve.mitre.org access.redhat.com blog.trailofbits.com github.com lore.kernel.org nvd.nist.gov security.gentoo.org security.netapp.com www.cve.org |
|
| LOW |
CVE-2024-28085: util-linux: CVE-2024-28085: wall: escape sequence injectionwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: 2.36.1-8+deb11u2 References: seclists.org www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com lists.debian.org mirrors.edge.kernel.org nvd.nist.gov people.rit.edu security.netapp.com ubuntu.com ubuntu.com www.cve.org www.openwall.com |
|
| LOW |
CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernamesA flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: bsdutils Installed Version: 1:2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
DLA-4485-1: ca-certificates - CA certificates updatePackage Name: ca-certificates Installed Version: 20210119 Fixed Version: 20230311+deb12u1~deb11u1 References: |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: libblkid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: libmount1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: libsmartcols1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3 ...A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.Package Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: gist.github.com github.com sqlite.org |
|
| UNKNOWN |
CVE-2026-50813: An issue in SQLite before Fossil check-in 869a51ae84df allows a local ...An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge pathPackage Name: libsqlite3-0 Installed Version: 3.34.1-3 Fixed Version: References: gist.github.com github.com sqlite.org |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: libuuid1 Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: mount Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| UNKNOWN |
CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow ...Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com github.com |
|
| UNKNOWN |
CVE-2026-7017: HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.Package Name: perl-base Installed Version: 5.32.1-4+deb11u2 Fixed Version: References: www.openwall.com github.com github.com github.com github.com metacpan.org |
|
| UNKNOWN |
DLA-3972-1: tzdata - new timezone databasePackage Name: tzdata Installed Version: 2021a-1+deb11u8 Fixed Version: 2024b-0+deb11u1 References: |
|
| UNKNOWN |
DLA-4085-1: tzdata - new timezone databasePackage Name: tzdata Installed Version: 2021a-1+deb11u8 Fixed Version: 2025a-0+deb11u1 References: |
|
| UNKNOWN |
DLA-4105-1: tzdata - new timezone databasePackage Name: tzdata Installed Version: 2021a-1+deb11u8 Fixed Version: 2025b-0+deb11u1 References: |
|
| UNKNOWN |
DLA-4403-1: tzdata - new timezone databasePackage Name: tzdata Installed Version: 2021a-1+deb11u8 Fixed Version: 2025b-0+deb11u2 References: |
|
| UNKNOWN |
DLA-4569-1: tzdata - new timezone databasePackage Name: tzdata Installed Version: 2021a-1+deb11u8 Fixed Version: 2026b-0+deb11u1 References: |
|
| UNKNOWN |
CVE-2026-53613: [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]Package Name: util-linux Installed Version: 2.36.1-8+deb11u1 Fixed Version: References: |
|
| Target: | Python | |
| HIGH |
CVE-2022-40897: pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.pyPython Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.Package Name: setuptools Installed Version: 57.5.0 Fixed Version: 65.5.1 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org nvd.nist.gov pyup.io pyup.io pyup.io pyup.io security.netapp.com security.netapp.com security.netapp.com security.netapp.com setuptools.pypa.io ubuntu.com www.cve.org |
|
| HIGH |
CVE-2024-6345: pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptoolsA vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.Package Name: setuptools Installed Version: 57.5.0 Fixed Version: 70.0.0 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com huntr.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com www.cve.org |
|
| HIGH |
CVE-2025-47273: setuptools: Path Traversal Vulnerability in setuptools PackageIndexsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.Package Name: setuptools Installed Version: 57.5.0 Fixed Version: 78.1.1 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org |
|
| MEDIUM |
CVE-2023-5752: pip: Mercurial configuration injectable in repo revision when installing via pipWhen installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.Package Name: pip Installed Version: 22.0.4 Fixed Version: 23.3 References: access.redhat.com github.com github.com github.com github.com lists.debian.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org lists.fedoraproject.org mail.python.org mail.python.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2025-8869: pip: pip missing checks on symbolic link extractionWhen extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.Package Name: pip Installed Version: 22.0.4 Fixed Version: 25.3 References: access.redhat.com github.com github.com github.com lists.debian.org mail.python.org mail.python.org nvd.nist.gov pip.pypa.io www.cve.org |
|
| MEDIUM |
CVE-2026-3219: pip: pip: Incorrect file installation due to improper archive handlingpip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.Package Name: pip Installed Version: 22.0.4 Fixed Version: 26.1 References: www.openwall.com access.redhat.com github.com github.com github.com mail.python.org mail.python.org nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-6357: pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installationpip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.Package Name: pip Installed Version: 22.0.4 Fixed Version: 26.1 References: www.openwall.com access.redhat.com github.com github.com github.com ichard26.github.io nvd.nist.gov www.cve.org |
|
| MEDIUM |
CVE-2026-8643: python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwritepip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.Package Name: pip Installed Version: 22.0.4 Fixed Version: 26.1.2 References: www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com linux.oracle.com linux.oracle.com mail.python.org mail.python.org nvd.nist.gov security.access.redhat.com www.cve.org |
|
| LOW |
CVE-2026-1703: pip: pip: Information disclosure via path traversal when installing crafted wheel archivesWhen pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.Package Name: pip Installed Version: 22.0.4 Fixed Version: 26.0 References: access.redhat.com github.com github.com github.com mail.python.org mail.python.org nvd.nist.gov www.cve.org |
|
Package statistics are no longer available on cloudsmith.io. Please visit our new web app to access this feature.
You can embed a badge in another website that shows this or the latest version of this package.
To embed the badge for this specific package version, use the following:
[](https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d/a=amd64;xpo=linux/)|This version of 'python' @ Cloudsmith|
.. |This version of 'python' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/3.8-slim-amd64/a=amd64;xpo=linux/?render=true
:target: https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d/a=amd64;xpo=linux/image::https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/3.8-slim-amd64/a=amd64;xpo=linux/?render=true[link="https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d/a=amd64;xpo=linux/",title="This version of 'python' @ Cloudsmith"]<a href="https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/b4e492dd480a64c1436e448735acc6435a574664eabb88e744b428ac3baa646d/a=amd64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/3.8-slim-amd64/a=amd64;xpo=linux/?render=true" alt="This version of 'python' @ Cloudsmith" /></a>rendered as:
To embed the badge for the latest package version, use the following:
[](https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/latest/a=amd64;xpo=linux/)|Latest version of 'python' @ Cloudsmith|
.. |Latest version of 'python' @ Cloudsmith| image:: https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/latest/a=amd64;xpo=linux/?render=true&show_latest=true
:target: https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/latest/a=amd64;xpo=linux/image::https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/latest/a=amd64;xpo=linux/?render=true&show_latest=true[link="https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/latest/a=amd64;xpo=linux/",title="Latest version of 'python' @ Cloudsmith"]<a href="https://cloudsmith.io/~cloudsmith/repos/actions-images/packages/detail/docker/python/latest/a=amd64;xpo=linux/"><img src="https://api.cloudsmith.com/v1/badges/version/cloudsmith/actions-images/docker/python/latest/a=amd64;xpo=linux/?render=true&show_latest=true" alt="Latest version of 'python' @ Cloudsmith" /></a>rendered as:
These instructions assume you have setup the repository first (or read it).
To pull python @ reference/tag 3.8-slim-amd64:
docker pull docker.cloudsmith.io/cloudsmith/actions-images/python:3.8-slim-amd64You can also pull the latest version of this image (if it exists):
docker pull docker.cloudsmith.io/cloudsmith/actions-images/python:latestTo refer to this image after pulling in a Dockerfile, specify the following:
FROM docker.cloudsmith.io/cloudsmith/actions-images/python:3.8-slim-amd64
Previous Version
