stiti/TP_Docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c370789ebaf29baea47b705a9f7e50ad6d11b558
TP_Docker/TP5/reports/nginx-scan.json

9182 lines
443 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"SchemaVersion": 2,
"CreatedAt": "2025-04-29T15:23:12.664002673Z",
"ArtifactName": "nginx:latest",
"ArtifactType": "container_image",
"Metadata": {
"Size": 196616192,
"OS": {
"Family": "debian",
"Name": "12.10"
},
"ImageID": "sha256:a830707172e8069c09cf6c67a04e23e5a1a332d70a90a54999b76273a928b9ce",
"DiffIDs": [
"sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c",
"sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38",
"sha256:46a24b5c31d8c214496acac6cc4245efc3e27fd04f2b66aa30647bdc0271cc11",
"sha256:286733b13b0fc9737a65b2f11d79c44c7c23a373d03eb85abc59f6e769eb6671",
"sha256:f8455d4eb3fff05a6c75a80704e661eb2777ff194a573d0eb9d2849f787afe21",
"sha256:d842334334377567945d0b67a318fb2584f042a1fad5af514e7ec73907de3bf3",
"sha256:8030dd26ec5df545d1f1326e23382a06ac79cf0c26ada971b5eba399e3b64703"
],
"RepoTags": [
"nginx:latest"
],
"RepoDigests": [
"nginx@sha256:c15da6c91de8d2f436196f3a768483ad32c258ed4e1beb3d367a27ed67253e66"
],
"ImageConfig": {
"architecture": "amd64",
"created": "2025-04-16T14:50:31Z",
"history": [
{
"created": "2025-04-16T14:50:31Z",
"created_by": "# debian.sh --arch 'amd64' out/ 'bookworm' '@1745798400'",
"comment": "debuerreotype 0.15"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "LABEL maintainer=NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENV NGINX_VERSION=1.27.5",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENV NJS_VERSION=0.8.10",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENV NJS_RELEASE=1~bookworm",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENV PKG_RELEASE=1~bookworm",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENV DYNPKG_RELEASE=1~bookworm",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "RUN /bin/sh -c set -x \u0026\u0026 groupadd --system --gid 101 nginx \u0026\u0026 useradd --system --gid nginx --no-create-home --home /nonexistent --comment \"nginx user\" --shell /bin/false --uid 101 nginx \u0026\u0026 apt-get update \u0026\u0026 apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates \u0026\u0026 NGINX_GPGKEYS=\"573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3\"; NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; export GNUPGHOME=\"$(mktemp -d)\"; found=''; for NGINX_GPGKEY in $NGINX_GPGKEYS; do for server in hkp://keyserver.ubuntu.com:80 pgp.mit.edu ; do echo \"Fetching GPG key $NGINX_GPGKEY from $server\"; gpg1 --keyserver \"$server\" --keyserver-options timeout=10 --recv-keys \"$NGINX_GPGKEY\" \u0026\u0026 found=yes \u0026\u0026 break; done; test -z \"$found\" \u0026\u0026 echo \u003e\u00262 \"error: failed to fetch GPG key $NGINX_GPGKEY\" \u0026\u0026 exit 1; done; gpg1 --export \"$NGINX_GPGKEYS\" \u003e \"$NGINX_GPGKEY_PATH\" ; rm -rf \"$GNUPGHOME\"; apt-get remove --purge --auto-remove -y gnupg1 \u0026\u0026 rm -rf /var/lib/apt/lists/* \u0026\u0026 dpkgArch=\"$(dpkg --print-architecture)\" \u0026\u0026 nginxPackages=\" nginx=${NGINX_VERSION}-${PKG_RELEASE} nginx-module-xslt=${NGINX_VERSION}-${DYNPKG_RELEASE} nginx-module-geoip=${NGINX_VERSION}-${DYNPKG_RELEASE} nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \" \u0026\u0026 case \"$dpkgArch\" in amd64|arm64) echo \"deb [signed-by=$NGINX_GPGKEY_PATH] https://nginx.org/packages/mainline/debian/ bookworm nginx\" \u003e\u003e /etc/apt/sources.list.d/nginx.list \u0026\u0026 apt-get update ;; *) tempDir=\"$(mktemp -d)\" \u0026\u0026 chmod 777 \"$tempDir\" \u0026\u0026 savedAptMark=\"$(apt-mark showmanual)\" \u0026\u0026 apt-get update \u0026\u0026 apt-get install --no-install-recommends --no-install-suggests -y curl devscripts equivs git libxml2-utils lsb-release xsltproc \u0026\u0026 ( cd \"$tempDir\" \u0026\u0026 REVISION=\"${NGINX_VERSION}-${PKG_RELEASE}\" \u0026\u0026 REVISION=${REVISION%~*} \u0026\u0026 curl -f -L -O https://github.com/nginx/pkg-oss/archive/${REVISION}.tar.gz \u0026\u0026 PKGOSSCHECKSUM=\"c773d98b567bd585c17f55702bf3e4c7d82b676bfbde395270e90a704dca3c758dfe0380b3f01770542b4fd9bed1f1149af4ce28bfc54a27a96df6b700ac1745 *${REVISION}.tar.gz\" \u0026\u0026 if [ \"$(openssl sha512 -r ${REVISION}.tar.gz)\" = \"$PKGOSSCHECKSUM\" ]; then echo \"pkg-oss tarball checksum verification succeeded!\"; else echo \"pkg-oss tarball checksum verification failed!\"; exit 1; fi \u0026\u0026 tar xzvf ${REVISION}.tar.gz \u0026\u0026 cd pkg-oss-${REVISION} \u0026\u0026 cd debian \u0026\u0026 for target in base module-geoip module-image-filter module-njs module-xslt; do make rules-$target; mk-build-deps --install --tool=\"apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes\" debuild-$target/nginx-$NGINX_VERSION/debian/control; done \u0026\u0026 make base module-geoip module-image-filter module-njs module-xslt ) \u0026\u0026 apt-mark showmanual | xargs apt-mark auto \u003e /dev/null \u0026\u0026 { [ -z \"$savedAptMark\" ] || apt-mark manual $savedAptMark; } \u0026\u0026 ls -lAFh \"$tempDir\" \u0026\u0026 ( cd \"$tempDir\" \u0026\u0026 dpkg-scanpackages . \u003e Packages ) \u0026\u0026 grep '^Package: ' \"$tempDir/Packages\" \u0026\u0026 echo \"deb [ trusted=yes ] file://$tempDir ./\" \u003e /etc/apt/sources.list.d/temp.list \u0026\u0026 apt-get -o Acquire::GzipIndexes=false update ;; esac \u0026\u0026 apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages gettext-base curl \u0026\u0026 apt-get remove --purge --auto-remove -y \u0026\u0026 rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list \u0026\u0026 if [ -n \"$tempDir\" ]; then apt-get purge -y --auto-remove \u0026\u0026 rm -rf \"$tempDir\" /etc/apt/sources.list.d/temp.list; fi \u0026\u0026 ln -sf /dev/stdout /var/log/nginx/access.log \u0026\u0026 ln -sf /dev/stderr /var/log/nginx/error.log \u0026\u0026 mkdir /docker-entrypoint.d # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "COPY docker-entrypoint.sh / # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "COPY 15-local-resolvers.envsh /docker-entrypoint.d # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "COPY 20-envsubst-on-templates.sh /docker-entrypoint.d # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "COPY 30-tune-worker-processes.sh /docker-entrypoint.d # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "ENTRYPOINT [\"/docker-entrypoint.sh\"]",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "EXPOSE map[80/tcp:{}]",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "STOPSIGNAL SIGQUIT",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2025-04-16T14:50:31Z",
"created_by": "CMD [\"nginx\" \"-g\" \"daemon off;\"]",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
}
],
"os": "linux",
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c",
"sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38",
"sha256:46a24b5c31d8c214496acac6cc4245efc3e27fd04f2b66aa30647bdc0271cc11",
"sha256:286733b13b0fc9737a65b2f11d79c44c7c23a373d03eb85abc59f6e769eb6671",
"sha256:f8455d4eb3fff05a6c75a80704e661eb2777ff194a573d0eb9d2849f787afe21",
"sha256:d842334334377567945d0b67a318fb2584f042a1fad5af514e7ec73907de3bf3",
"sha256:8030dd26ec5df545d1f1326e23382a06ac79cf0c26ada971b5eba399e3b64703"
]
},
"config": {
"Cmd": [
"nginx",
"-g",
"daemon off;"
],
"Entrypoint": [
"/docker-entrypoint.sh"
],
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NGINX_VERSION=1.27.5",
"NJS_VERSION=0.8.10",
"NJS_RELEASE=1~bookworm",
"PKG_RELEASE=1~bookworm",
"DYNPKG_RELEASE=1~bookworm"
],
"Labels": {
"maintainer": "NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e"
},
"ExposedPorts": {
"80/tcp": {}
},
"StopSignal": "SIGQUIT"
}
},
"Layers": [
{
"Size": 77895680,
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
{
"Size": 118697472,
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
{
"Size": 3584,
"Digest": "sha256:3e544d53ce49d405a41bd59e97d102d77cc5412a717b3bae2295d237ccdfb706",
"DiffID": "sha256:46a24b5c31d8c214496acac6cc4245efc3e27fd04f2b66aa30647bdc0271cc11"
},
{
"Size": 4608,
"Digest": "sha256:4f21ed9ac0c04aa7c64ffd32df025f4545ab9f007d175ce82c920903590daec7",
"DiffID": "sha256:286733b13b0fc9737a65b2f11d79c44c7c23a373d03eb85abc59f6e769eb6671"
},
{
"Size": 2560,
"Digest": "sha256:d38f2ef2d6f270e6bc87cad48e49a5ec4ebdd2f5d1d4955c4df3780dabbf2393",
"DiffID": "sha256:f8455d4eb3fff05a6c75a80704e661eb2777ff194a573d0eb9d2849f787afe21"
},
{
"Size": 5120,
"Digest": "sha256:40a6e9f4e4564bc7213f3983964e76c27e1dc94ceb473f04a8460f5e95e365d1",
"DiffID": "sha256:d842334334377567945d0b67a318fb2584f042a1fad5af514e7ec73907de3bf3"
},
{
"Size": 7168,
"Digest": "sha256:d3dc5ec71e9d6d1a06a1740efb4a875b28b102166509c8563c90b48f7c5e0bcb",
"DiffID": "sha256:8030dd26ec5df545d1f1326e23382a06ac79cf0c26ada971b5eba399e3b64703"
}
]
},
"Results": [
{
"Target": "nginx:latest (debian 12.10)",
"Class": "os-pkgs",
"Type": "debian",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2011-3374",
"PkgID": "apt@2.6.1",
"PkgName": "apt",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/apt@2.6.1?arch=amd64\u0026distro=debian-12.10",
"UID": "d08c5489d80bc317"
},
"InstalledVersion": "2.6.1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "It was found that apt-key in apt, all versions, do not correctly valid ...",
"Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.",
"Severity": "LOW",
"CweIDs": [
"CWE-347"
],
"VendorSeverity": {
"debian": 1,
"nvd": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V2Score": 4.3,
"V3Score": 3.7
}
},
"References": [
"https://access.redhat.com/security/cve/cve-2011-3374",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480",
"https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html",
"https://seclists.org/fulldisclosure/2011/Sep/221",
"https://security-tracker.debian.org/tracker/CVE-2011-3374",
"https://snyk.io/vuln/SNYK-LINUX-APT-116518",
"https://ubuntu.com/security/CVE-2011-3374"
],
"PublishedDate": "2019-11-26T00:15:11.03Z",
"LastModifiedDate": "2024-11-21T01:30:22.61Z"
},
{
"VulnerabilityID": "TEMP-0841856-B18BAF",
"PkgID": "bash@5.2.15-2+b7",
"PkgName": "bash",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/bash@5.2.15-2%2Bb7?arch=amd64\u0026distro=debian-12.10",
"UID": "9bf7a8e6bd5c6485"
},
"InstalledVersion": "5.2.15-2+b7",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0841856-B18BAF",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "[Privilege escalation possible to other user than root]",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1
}
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "bsdutils@1:2.38.1-5+deb12u3",
"PkgName": "bsdutils",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "b5147cb35d13a963"
},
"InstalledVersion": "1:2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2016-2781",
"PkgID": "coreutils@9.1-1",
"PkgName": "coreutils",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.10",
"UID": "bed513a0ab732758"
},
"InstalledVersion": "9.1-1",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-2781",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "coreutils: Non-privileged session can escape to the parent session in chroot",
"Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
"Severity": "LOW",
"CweIDs": [
"CWE-20"
],
"VendorSeverity": {
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"V2Score": 2.1,
"V3Score": 6.5
},
"redhat": {
"V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"V2Score": 6.2,
"V3Score": 8.6
}
},
"References": [
"http://seclists.org/oss-sec/2016/q1/452",
"http://www.openwall.com/lists/oss-security/2016/02/28/2",
"http://www.openwall.com/lists/oss-security/2016/02/28/3",
"https://access.redhat.com/security/cve/CVE-2016-2781",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://lore.kernel.org/patchwork/patch/793178/",
"https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes",
"https://nvd.nist.gov/vuln/detail/CVE-2016-2781",
"https://www.cve.org/CVERecord?id=CVE-2016-2781"
],
"PublishedDate": "2017-02-07T15:59:00.333Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2017-18018",
"PkgID": "coreutils@9.1-1",
"PkgName": "coreutils",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.10",
"UID": "bed513a0ab732758"
},
"InstalledVersion": "9.1-1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-18018",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "coreutils: race condition vulnerability in chown and chgrp",
"Description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.",
"Severity": "LOW",
"CweIDs": [
"CWE-362"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 1.9,
"V3Score": 4.7
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"V3Score": 4.2
}
},
"References": [
"http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html",
"https://access.redhat.com/security/cve/CVE-2017-18018",
"https://nvd.nist.gov/vuln/detail/CVE-2017-18018",
"https://www.cve.org/CVERecord?id=CVE-2017-18018"
],
"PublishedDate": "2018-01-04T04:29:00.19Z",
"LastModifiedDate": "2024-11-21T03:19:10.713Z"
},
{
"VulnerabilityID": "CVE-2024-2379",
"PkgID": "curl@7.88.1-10+deb12u12",
"PkgName": "curl",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/curl@7.88.1-10%2Bdeb12u12?arch=amd64\u0026distro=debian-12.10",
"UID": "ffb7e6418760458f"
},
"InstalledVersion": "7.88.1-10+deb12u12",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-2379",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "curl: QUIC certificate check bypass with wolfSSL",
"Description": "libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.",
"Severity": "LOW",
"VendorSeverity": {
"azure": 2,
"debian": 1,
"redhat": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 5.4
}
},
"References": [
"http://seclists.org/fulldisclosure/2024/Jul/18",
"http://seclists.org/fulldisclosure/2024/Jul/19",
"http://seclists.org/fulldisclosure/2024/Jul/20",
"http://www.openwall.com/lists/oss-security/2024/03/27/2",
"https://access.redhat.com/security/cve/CVE-2024-2379",
"https://curl.se/docs/CVE-2024-2379.html",
"https://curl.se/docs/CVE-2024-2379.json",
"https://hackerone.com/reports/2410774",
"https://nvd.nist.gov/vuln/detail/CVE-2024-2379",
"https://security.netapp.com/advisory/ntap-20240531-0001/",
"https://support.apple.com/kb/HT214118",
"https://support.apple.com/kb/HT214119",
"https://support.apple.com/kb/HT214120",
"https://www.cve.org/CVERecord?id=CVE-2024-2379"
],
"PublishedDate": "2024-03-27T08:15:41.23Z",
"LastModifiedDate": "2024-11-21T09:09:37.57Z"
},
{
"VulnerabilityID": "CVE-2025-0725",
"PkgID": "curl@7.88.1-10+deb12u12",
"PkgName": "curl",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/curl@7.88.1-10%2Bdeb12u12?arch=amd64\u0026distro=debian-12.10",
"UID": "ffb7e6418760458f"
},
"InstalledVersion": "7.88.1-10+deb12u12",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-0725",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libcurl: Buffer Overflow in libcurl via zlib Integer Overflow",
"Description": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.",
"Severity": "LOW",
"VendorSeverity": {
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"redhat": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 4
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2025/02/05/3",
"http://www.openwall.com/lists/oss-security/2025/02/06/2",
"http://www.openwall.com/lists/oss-security/2025/02/06/4",
"https://access.redhat.com/security/cve/CVE-2025-0725",
"https://curl.se/docs/CVE-2025-0725.html",
"https://curl.se/docs/CVE-2025-0725.json",
"https://hackerone.com/reports/2956023",
"https://nvd.nist.gov/vuln/detail/CVE-2025-0725",
"https://security.netapp.com/advisory/ntap-20250306-0009/",
"https://www.cve.org/CVERecord?id=CVE-2025-0725"
],
"PublishedDate": "2025-02-05T10:15:22.98Z",
"LastModifiedDate": "2025-03-07T01:15:12.403Z"
},
{
"VulnerabilityID": "CVE-2022-27943",
"PkgID": "gcc-12-base@12.2.0-14",
"PkgName": "gcc-12-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/gcc-12-base@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "9a668c24c45de553"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const",
"Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"amazon": 1,
"debian": 1,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-27943",
"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead",
"https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-27943",
"https://sourceware.org/bugzilla/show_bug.cgi?id=28995",
"https://www.cve.org/CVERecord?id=CVE-2022-27943"
],
"PublishedDate": "2022-03-26T13:15:07.9Z",
"LastModifiedDate": "2024-11-21T06:56:31.04Z"
},
{
"VulnerabilityID": "CVE-2023-4039",
"PkgID": "gcc-12-base@12.2.0-14",
"PkgName": "gcc-12-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/gcc-12-base@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "9a668c24c45de553"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64",
"Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
"Severity": "LOW",
"CweIDs": [
"CWE-693"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"oracle-oval": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-4039",
"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64",
"https://gcc.gnu.org/git/?p=gcc.git;a=blob_plain;f=SECURITY.txt",
"https://gcc.gnu.org/pipermail/gcc-patches/2023-October/634066.html",
"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf",
"https://inbox.sourceware.org/gcc-patches/46cfa37b-56eb-344d-0745-e0d35393392d@gotplt.org",
"https://linux.oracle.com/cve/CVE-2023-4039.html",
"https://linux.oracle.com/errata/ELSA-2023-28766.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4039",
"https://rtx.meta.security/mitigation/2023/09/12/CVE-2023-4039.html",
"https://www.cve.org/CVERecord?id=CVE-2023-4039"
],
"PublishedDate": "2023-09-13T09:15:15.69Z",
"LastModifiedDate": "2025-02-13T17:17:14.717Z"
},
{
"VulnerabilityID": "CVE-2022-3219",
"PkgID": "gpgv@2.2.40-1.1",
"PkgName": "gpgv",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/gpgv@2.2.40-1.1?arch=amd64\u0026distro=debian-12.10",
"UID": "7e56e6619044133a"
},
"InstalledVersion": "2.2.40-1.1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3219",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "gnupg: denial of service issue (resource consumption) using compressed packets",
"Description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.",
"Severity": "LOW",
"CweIDs": [
"CWE-787"
],
"VendorSeverity": {
"debian": 1,
"nvd": 1,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 3.3
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 6.2
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-3219",
"https://bugzilla.redhat.com/show_bug.cgi?id=2127010",
"https://dev.gnupg.org/D556",
"https://dev.gnupg.org/T5993",
"https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3219",
"https://security.netapp.com/advisory/ntap-20230324-0001/",
"https://www.cve.org/CVERecord?id=CVE-2022-3219"
],
"PublishedDate": "2023-02-23T20:15:12.393Z",
"LastModifiedDate": "2025-03-12T21:15:38.207Z"
},
{
"VulnerabilityID": "CVE-2025-30258",
"PkgID": "gpgv@2.2.40-1.1",
"PkgName": "gpgv",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/gpgv@2.2.40-1.1?arch=amd64\u0026distro=debian-12.10",
"UID": "7e56e6619044133a"
},
"InstalledVersion": "2.2.40-1.1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-30258",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "gnupg: verification DoS due to a malicious subkey in the keyring",
"Description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-754"
],
"VendorSeverity": {
"redhat": 1,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L",
"V3Score": 2.7
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-30258",
"https://dev.gnupg.org/T7527",
"https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158",
"https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-30258",
"https://ubuntu.com/security/notices/USN-7412-1",
"https://www.cve.org/CVERecord?id=CVE-2025-30258"
],
"PublishedDate": "2025-03-19T20:15:20.14Z",
"LastModifiedDate": "2025-03-19T20:15:20.14Z"
},
{
"VulnerabilityID": "CVE-2025-0838",
"PkgID": "libabsl20220623@20220623.1-1",
"PkgName": "libabsl20220623",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libabsl20220623@20220623.1-1?arch=amd64\u0026distro=debian-12.10",
"UID": "f2018780fcadc561"
},
"InstalledVersion": "20220623.1-1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-0838",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "abseil-cpp: Heap Buffer overflow in Abseil",
"Description": "There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
"V3Score": 5.6
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-0838",
"https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1",
"https://lists.debian.org/debian-lts-announce/2025/04/msg00012.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-0838",
"https://www.cve.org/CVERecord?id=CVE-2025-0838"
],
"PublishedDate": "2025-02-21T15:15:11.89Z",
"LastModifiedDate": "2025-04-05T16:15:33.45Z"
},
{
"VulnerabilityID": "CVE-2023-6879",
"PkgID": "libaom3@3.6.0-1+deb12u1",
"PkgName": "libaom3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "2af453d8c99d1627"
},
"InstalledVersion": "3.6.0-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6879",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "aom: heap-buffer-overflow on frame size change",
"Description": "Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().",
"Severity": "CRITICAL",
"CweIDs": [
"CWE-20",
"CWE-787"
],
"VendorSeverity": {
"nvd": 4,
"redhat": 3
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 9.8
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 9.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-6879",
"https://aomedia.googlesource.com/aom/+/refs/tags/v3.7.1",
"https://crbug.com/aomedia/3491",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-6879",
"https://www.cve.org/CVERecord?id=CVE-2023-6879"
],
"PublishedDate": "2023-12-27T23:15:07.53Z",
"LastModifiedDate": "2025-02-13T18:16:11.25Z"
},
{
"VulnerabilityID": "CVE-2023-39616",
"PkgID": "libaom3@3.6.0-1+deb12u1",
"PkgName": "libaom3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "2af453d8c99d1627"
},
"InstalledVersion": "3.6.0-1+deb12u1",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39616",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read mem ...",
"Description": "AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.",
"Severity": "HIGH",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"nvd": 3
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3"
],
"PublishedDate": "2023-08-29T17:15:12.633Z",
"LastModifiedDate": "2024-11-21T08:15:42.747Z"
},
{
"VulnerabilityID": "CVE-2011-3374",
"PkgID": "libapt-pkg6.0@2.6.1",
"PkgName": "libapt-pkg6.0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=amd64\u0026distro=debian-12.10",
"UID": "c802efe78032f16d"
},
"InstalledVersion": "2.6.1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "It was found that apt-key in apt, all versions, do not correctly valid ...",
"Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.",
"Severity": "LOW",
"CweIDs": [
"CWE-347"
],
"VendorSeverity": {
"debian": 1,
"nvd": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V2Score": 4.3,
"V3Score": 3.7
}
},
"References": [
"https://access.redhat.com/security/cve/cve-2011-3374",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480",
"https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html",
"https://seclists.org/fulldisclosure/2011/Sep/221",
"https://security-tracker.debian.org/tracker/CVE-2011-3374",
"https://snyk.io/vuln/SNYK-LINUX-APT-116518",
"https://ubuntu.com/security/CVE-2011-3374"
],
"PublishedDate": "2019-11-26T00:15:11.03Z",
"LastModifiedDate": "2024-11-21T01:30:22.61Z"
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "libblkid1@2.38.1-5+deb12u3",
"PkgName": "libblkid1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "db8b5ae53bf85f30"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2010-4756",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions",
"Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
"Severity": "LOW",
"CweIDs": [
"CWE-399"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"V2Score": 4
},
"redhat": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V2Score": 5
}
},
"References": [
"http://cxib.net/stuff/glob-0day.c",
"http://securityreason.com/achievement_securityalert/89",
"http://securityreason.com/exploitalert/9223",
"https://access.redhat.com/security/cve/CVE-2010-4756",
"https://bugzilla.redhat.com/show_bug.cgi?id=681681",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756",
"https://nvd.nist.gov/vuln/detail/CVE-2010-4756",
"https://www.cve.org/CVERecord?id=CVE-2010-4756"
],
"PublishedDate": "2011-03-02T20:00:01.037Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2018-20796",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 5.3
}
},
"References": [
"http://www.securityfocus.com/bid/107160",
"https://access.redhat.com/security/cve/CVE-2018-20796",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141",
"https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html",
"https://nvd.nist.gov/vuln/detail/CVE-2018-20796",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://www.cve.org/CVERecord?id=CVE-2018-20796"
],
"PublishedDate": "2019-02-26T02:29:00.45Z",
"LastModifiedDate": "2024-11-21T04:02:11.827Z"
},
{
"VulnerabilityID": "CVE-2019-1010022",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: stack guard protection bypass",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"debian": 1,
"nvd": 4
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V2Score": 7.5,
"V3Score": 9.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1010022",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022",
"https://security-tracker.debian.org/tracker/CVE-2019-1010022",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22850",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3",
"https://ubuntu.com/security/CVE-2019-1010022",
"https://www.cve.org/CVERecord?id=CVE-2019-1010022"
],
"PublishedDate": "2019-07-15T04:15:13.317Z",
"LastModifiedDate": "2024-11-21T04:17:55.5Z"
},
{
"VulnerabilityID": "CVE-2019-1010023",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation",
"Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V2Score": 6.8,
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 7.8
}
},
"References": [
"http://www.securityfocus.com/bid/109167",
"https://access.redhat.com/security/cve/CVE-2019-1010023",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023",
"https://security-tracker.debian.org/tracker/CVE-2019-1010023",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22851",
"https://support.f5.com/csp/article/K11932200?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010023",
"https://www.cve.org/CVERecord?id=CVE-2019-1010023"
],
"PublishedDate": "2019-07-15T04:15:13.397Z",
"LastModifiedDate": "2024-11-21T04:17:55.643Z"
},
{
"VulnerabilityID": "CVE-2019-1010024",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: ASLR bypass using cache of thread stack and heap",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"CweIDs": [
"CWE-200"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 5.3
}
},
"References": [
"http://www.securityfocus.com/bid/109162",
"https://access.redhat.com/security/cve/CVE-2019-1010024",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024",
"https://security-tracker.debian.org/tracker/CVE-2019-1010024",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22852",
"https://support.f5.com/csp/article/K06046097",
"https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010024",
"https://www.cve.org/CVERecord?id=CVE-2019-1010024"
],
"PublishedDate": "2019-07-15T04:15:13.473Z",
"LastModifiedDate": "2024-11-21T04:17:55.843Z"
},
{
"VulnerabilityID": "CVE-2019-1010025",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: information disclosure of heap addresses of pthread_created thread",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.",
"Severity": "LOW",
"CweIDs": [
"CWE-330"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 2.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1010025",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025",
"https://security-tracker.debian.org/tracker/CVE-2019-1010025",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22853",
"https://support.f5.com/csp/article/K06046097",
"https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010025",
"https://www.cve.org/CVERecord?id=CVE-2019-1010025"
],
"PublishedDate": "2019-07-15T04:15:13.537Z",
"LastModifiedDate": "2024-11-21T04:17:55.96Z"
},
{
"VulnerabilityID": "CVE-2019-9192",
"PkgID": "libc-bin@2.36-9+deb12u10",
"PkgName": "libc-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "205f0e4a1d969bcb"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 2.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-9192",
"https://nvd.nist.gov/vuln/detail/CVE-2019-9192",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24269",
"https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://www.cve.org/CVERecord?id=CVE-2019-9192"
],
"PublishedDate": "2019-02-26T18:29:00.34Z",
"LastModifiedDate": "2024-11-21T04:51:10.53Z"
},
{
"VulnerabilityID": "CVE-2010-4756",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions",
"Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
"Severity": "LOW",
"CweIDs": [
"CWE-399"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"V2Score": 4
},
"redhat": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V2Score": 5
}
},
"References": [
"http://cxib.net/stuff/glob-0day.c",
"http://securityreason.com/achievement_securityalert/89",
"http://securityreason.com/exploitalert/9223",
"https://access.redhat.com/security/cve/CVE-2010-4756",
"https://bugzilla.redhat.com/show_bug.cgi?id=681681",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756",
"https://nvd.nist.gov/vuln/detail/CVE-2010-4756",
"https://www.cve.org/CVERecord?id=CVE-2010-4756"
],
"PublishedDate": "2011-03-02T20:00:01.037Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2018-20796",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 5.3
}
},
"References": [
"http://www.securityfocus.com/bid/107160",
"https://access.redhat.com/security/cve/CVE-2018-20796",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141",
"https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html",
"https://nvd.nist.gov/vuln/detail/CVE-2018-20796",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://www.cve.org/CVERecord?id=CVE-2018-20796"
],
"PublishedDate": "2019-02-26T02:29:00.45Z",
"LastModifiedDate": "2024-11-21T04:02:11.827Z"
},
{
"VulnerabilityID": "CVE-2019-1010022",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: stack guard protection bypass",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"debian": 1,
"nvd": 4
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V2Score": 7.5,
"V3Score": 9.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1010022",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022",
"https://security-tracker.debian.org/tracker/CVE-2019-1010022",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22850",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3",
"https://ubuntu.com/security/CVE-2019-1010022",
"https://www.cve.org/CVERecord?id=CVE-2019-1010022"
],
"PublishedDate": "2019-07-15T04:15:13.317Z",
"LastModifiedDate": "2024-11-21T04:17:55.5Z"
},
{
"VulnerabilityID": "CVE-2019-1010023",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation",
"Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V2Score": 6.8,
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 7.8
}
},
"References": [
"http://www.securityfocus.com/bid/109167",
"https://access.redhat.com/security/cve/CVE-2019-1010023",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023",
"https://security-tracker.debian.org/tracker/CVE-2019-1010023",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22851",
"https://support.f5.com/csp/article/K11932200?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010023",
"https://www.cve.org/CVERecord?id=CVE-2019-1010023"
],
"PublishedDate": "2019-07-15T04:15:13.397Z",
"LastModifiedDate": "2024-11-21T04:17:55.643Z"
},
{
"VulnerabilityID": "CVE-2019-1010024",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: ASLR bypass using cache of thread stack and heap",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.",
"Severity": "LOW",
"CweIDs": [
"CWE-200"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 5.3
}
},
"References": [
"http://www.securityfocus.com/bid/109162",
"https://access.redhat.com/security/cve/CVE-2019-1010024",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024",
"https://security-tracker.debian.org/tracker/CVE-2019-1010024",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22852",
"https://support.f5.com/csp/article/K06046097",
"https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010024",
"https://www.cve.org/CVERecord?id=CVE-2019-1010024"
],
"PublishedDate": "2019-07-15T04:15:13.473Z",
"LastModifiedDate": "2024-11-21T04:17:55.843Z"
},
{
"VulnerabilityID": "CVE-2019-1010025",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: information disclosure of heap addresses of pthread_created thread",
"Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.",
"Severity": "LOW",
"CweIDs": [
"CWE-330"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 2.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1010025",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025",
"https://security-tracker.debian.org/tracker/CVE-2019-1010025",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22853",
"https://support.f5.com/csp/article/K06046097",
"https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://ubuntu.com/security/CVE-2019-1010025",
"https://www.cve.org/CVERecord?id=CVE-2019-1010025"
],
"PublishedDate": "2019-07-15T04:15:13.537Z",
"LastModifiedDate": "2024-11-21T04:17:55.96Z"
},
{
"VulnerabilityID": "CVE-2019-9192",
"PkgID": "libc6@2.36-9+deb12u10",
"PkgName": "libc6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64\u0026distro=debian-12.10",
"UID": "1a7eeabc0a4eae7"
},
"InstalledVersion": "2.36-9+deb12u10",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 2.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-9192",
"https://nvd.nist.gov/vuln/detail/CVE-2019-9192",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24269",
"https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS",
"https://www.cve.org/CVERecord?id=CVE-2019-9192"
],
"PublishedDate": "2019-02-26T18:29:00.34Z",
"LastModifiedDate": "2024-11-21T04:51:10.53Z"
},
{
"VulnerabilityID": "CVE-2025-1390",
"PkgID": "libcap2@1:2.66-4",
"PkgName": "libcap2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libcap2@2.66-4?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "59e5af23bbe95278"
},
"InstalledVersion": "1:2.66-4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1390",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libcap: pam_cap: Fix potential configuration parsing error",
"Description": "The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-284"
],
"VendorSeverity": {
"amazon": 3,
"azure": 2,
"cbl-mariner": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"V3Score": 6.1
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-1390",
"https://bugzilla.openanolis.cn/show_bug.cgi?id=18804",
"https://nvd.nist.gov/vuln/detail/CVE-2025-1390",
"https://ubuntu.com/security/notices/USN-7287-1",
"https://www.cve.org/CVERecord?id=CVE-2025-1390"
],
"PublishedDate": "2025-02-18T03:15:10.447Z",
"LastModifiedDate": "2025-02-18T03:15:10.447Z"
},
{
"VulnerabilityID": "CVE-2024-2379",
"PkgID": "libcurl4@7.88.1-10+deb12u12",
"PkgName": "libcurl4",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libcurl4@7.88.1-10%2Bdeb12u12?arch=amd64\u0026distro=debian-12.10",
"UID": "963e31acaaab5995"
},
"InstalledVersion": "7.88.1-10+deb12u12",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-2379",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "curl: QUIC certificate check bypass with wolfSSL",
"Description": "libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.",
"Severity": "LOW",
"VendorSeverity": {
"azure": 2,
"debian": 1,
"redhat": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 5.4
}
},
"References": [
"http://seclists.org/fulldisclosure/2024/Jul/18",
"http://seclists.org/fulldisclosure/2024/Jul/19",
"http://seclists.org/fulldisclosure/2024/Jul/20",
"http://www.openwall.com/lists/oss-security/2024/03/27/2",
"https://access.redhat.com/security/cve/CVE-2024-2379",
"https://curl.se/docs/CVE-2024-2379.html",
"https://curl.se/docs/CVE-2024-2379.json",
"https://hackerone.com/reports/2410774",
"https://nvd.nist.gov/vuln/detail/CVE-2024-2379",
"https://security.netapp.com/advisory/ntap-20240531-0001/",
"https://support.apple.com/kb/HT214118",
"https://support.apple.com/kb/HT214119",
"https://support.apple.com/kb/HT214120",
"https://www.cve.org/CVERecord?id=CVE-2024-2379"
],
"PublishedDate": "2024-03-27T08:15:41.23Z",
"LastModifiedDate": "2024-11-21T09:09:37.57Z"
},
{
"VulnerabilityID": "CVE-2025-0725",
"PkgID": "libcurl4@7.88.1-10+deb12u12",
"PkgName": "libcurl4",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libcurl4@7.88.1-10%2Bdeb12u12?arch=amd64\u0026distro=debian-12.10",
"UID": "963e31acaaab5995"
},
"InstalledVersion": "7.88.1-10+deb12u12",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-0725",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libcurl: Buffer Overflow in libcurl via zlib Integer Overflow",
"Description": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.",
"Severity": "LOW",
"VendorSeverity": {
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"redhat": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 4
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2025/02/05/3",
"http://www.openwall.com/lists/oss-security/2025/02/06/2",
"http://www.openwall.com/lists/oss-security/2025/02/06/4",
"https://access.redhat.com/security/cve/CVE-2025-0725",
"https://curl.se/docs/CVE-2025-0725.html",
"https://curl.se/docs/CVE-2025-0725.json",
"https://hackerone.com/reports/2956023",
"https://nvd.nist.gov/vuln/detail/CVE-2025-0725",
"https://security.netapp.com/advisory/ntap-20250306-0009/",
"https://www.cve.org/CVERecord?id=CVE-2025-0725"
],
"PublishedDate": "2025-02-05T10:15:22.98Z",
"LastModifiedDate": "2025-03-07T01:15:12.403Z"
},
{
"VulnerabilityID": "CVE-2023-32570",
"PkgID": "libdav1d6@1.0.0-2+deb12u1",
"PkgName": "libdav1d6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libdav1d6@1.0.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "82973a517c23dc92"
},
"InstalledVersion": "1.0.0-2+deb12u1",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-32570",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that ca ...",
"Description": "VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-362"
],
"VendorSeverity": {
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa",
"https://code.videolan.org/videolan/dav1d/-/tags/1.2.0",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/",
"https://security.gentoo.org/glsa/202310-05"
],
"PublishedDate": "2023-05-10T05:15:12.19Z",
"LastModifiedDate": "2025-01-28T16:15:36.333Z"
},
{
"VulnerabilityID": "CVE-2023-51792",
"PkgID": "libde265-0@1.0.11-1+deb12u2",
"PkgName": "libde265-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libde265-0@1.0.11-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "43084ec079e1d31c"
},
"InstalledVersion": "1.0.11-1+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-51792",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attac ...",
"Description": "Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the maximum supported size of 0x10000000000.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-121"
],
"VendorSeverity": {
"ubuntu": 2
},
"References": [
"https://github.com/strukturag/libde265",
"https://github.com/strukturag/libde265/issues/427",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/",
"https://ubuntu.com/security/notices/USN-6764-1",
"https://www.cve.org/CVERecord?id=CVE-2023-51792"
],
"PublishedDate": "2024-04-19T17:15:52.24Z",
"LastModifiedDate": "2024-11-21T08:38:49.18Z"
},
{
"VulnerabilityID": "CVE-2024-38949",
"PkgID": "libde265-0@1.0.11-1+deb12u2",
"PkgName": "libde265-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libde265-0@1.0.11-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "43084ec079e1d31c"
},
"InstalledVersion": "1.0.11-1+deb12u2",
"Status": "fix_deferred",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-38949",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attacker ...",
"Description": "Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-122"
],
"VendorSeverity": {
"ubuntu": 2
},
"References": [
"https://github.com/strukturag/libde265/issues/460",
"https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-38949",
"https://www.cve.org/CVERecord?id=CVE-2024-38949"
],
"PublishedDate": "2024-06-26T20:15:16.263Z",
"LastModifiedDate": "2024-11-21T09:27:00.007Z"
},
{
"VulnerabilityID": "CVE-2024-38950",
"PkgID": "libde265-0@1.0.11-1+deb12u2",
"PkgName": "libde265-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libde265-0@1.0.11-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "43084ec079e1d31c"
},
"InstalledVersion": "1.0.11-1+deb12u2",
"Status": "fix_deferred",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-38950",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attacker ...",
"Description": "Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-122"
],
"VendorSeverity": {
"ubuntu": 2
},
"References": [
"https://github.com/strukturag/libde265/issues/460",
"https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-38950",
"https://www.cve.org/CVERecord?id=CVE-2024-38950"
],
"PublishedDate": "2024-06-26T20:15:16.367Z",
"LastModifiedDate": "2024-11-21T09:27:00.26Z"
},
{
"VulnerabilityID": "CVE-2023-52425",
"PkgID": "libexpat1@2.5.0-1+deb12u1",
"PkgName": "libexpat1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "de8a0c0c9f928741"
},
"InstalledVersion": "2.5.0-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52425",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "expat: parsing large tokens can trigger a denial of service",
"Description": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.",
"Severity": "HIGH",
"CweIDs": [
"CWE-400"
],
"VendorSeverity": {
"alma": 2,
"amazon": 3,
"azure": 3,
"cbl-mariner": 3,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/03/20/5",
"https://access.redhat.com/errata/RHSA-2024:1530",
"https://access.redhat.com/security/cve/CVE-2023-52425",
"https://bugzilla.redhat.com/2262877",
"https://bugzilla.redhat.com/2268766",
"https://bugzilla.redhat.com/show_bug.cgi?id=2262877",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52425",
"https://errata.almalinux.org/9/ALSA-2024-1530.html",
"https://errata.rockylinux.org/RLSA-2024:1615",
"https://github.com/libexpat/libexpat/pull/789",
"https://linux.oracle.com/cve/CVE-2023-52425.html",
"https://linux.oracle.com/errata/ELSA-2024-4259.html",
"https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-52425",
"https://security.netapp.com/advisory/ntap-20240614-0003/",
"https://ubuntu.com/security/notices/USN-6694-1",
"https://www.cve.org/CVERecord?id=CVE-2023-52425"
],
"PublishedDate": "2024-02-04T20:15:46.063Z",
"LastModifiedDate": "2024-11-21T08:39:43.393Z"
},
{
"VulnerabilityID": "CVE-2024-8176",
"PkgID": "libexpat1@2.5.0-1+deb12u1",
"PkgName": "libexpat1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "de8a0c0c9f928741"
},
"InstalledVersion": "2.5.0-1+deb12u1",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-8176",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat",
"Description": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.",
"Severity": "HIGH",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"alma": 2,
"azure": 3,
"cbl-mariner": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2025/03/15/1",
"https://access.redhat.com/errata/RHSA-2025:3531",
"https://access.redhat.com/errata/RHSA-2025:3734",
"https://access.redhat.com/errata/RHSA-2025:3913",
"https://access.redhat.com/errata/RHSA-2025:4048",
"https://access.redhat.com/security/cve/CVE-2024-8176",
"https://blog.hartwork.org/posts/expat-2-7-0-released/",
"https://bugzilla.redhat.com/2310137",
"https://bugzilla.redhat.com/show_bug.cgi?id=2310137",
"https://bugzilla.suse.com/show_bug.cgi?id=1239618",
"https://errata.almalinux.org/9/ALSA-2025-3531.html",
"https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52",
"https://github.com/libexpat/libexpat/issues/893",
"https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53",
"https://linux.oracle.com/cve/CVE-2024-8176.html",
"https://linux.oracle.com/errata/ELSA-2025-4048.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-8176",
"https://security-tracker.debian.org/tracker/CVE-2024-8176",
"https://security.netapp.com/advisory/ntap-20250328-0009/",
"https://ubuntu.com/security/CVE-2024-8176",
"https://ubuntu.com/security/notices/USN-7424-1",
"https://www.cve.org/CVERecord?id=CVE-2024-8176"
],
"PublishedDate": "2025-03-14T09:15:14.157Z",
"LastModifiedDate": "2025-04-23T12:15:15.957Z"
},
{
"VulnerabilityID": "CVE-2024-50602",
"PkgID": "libexpat1@2.5.0-1+deb12u1",
"PkgName": "libexpat1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "de8a0c0c9f928741"
},
"InstalledVersion": "2.5.0-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50602",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libexpat: expat: DoS via XML_ResumeParser",
"Description": "An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-754"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"bitnami": 2,
"cbl-mariner": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9541",
"https://access.redhat.com/security/cve/CVE-2024-50602",
"https://bugzilla.redhat.com/2321987",
"https://bugzilla.redhat.com/show_bug.cgi?id=2321987",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50602",
"https://errata.almalinux.org/9/ALSA-2024-9541.html",
"https://errata.rockylinux.org/RLSA-2024:9502",
"https://github.com/libexpat/libexpat/pull/915",
"https://linux.oracle.com/cve/CVE-2024-50602.html",
"https://linux.oracle.com/errata/ELSA-2024-9541.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-50602",
"https://security.netapp.com/advisory/ntap-20250404-0008/",
"https://www.cve.org/CVERecord?id=CVE-2024-50602"
],
"PublishedDate": "2024-10-27T05:15:04.09Z",
"LastModifiedDate": "2024-10-30T18:35:16.237Z"
},
{
"VulnerabilityID": "CVE-2023-52426",
"PkgID": "libexpat1@2.5.0-1+deb12u1",
"PkgName": "libexpat1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "de8a0c0c9f928741"
},
"InstalledVersion": "2.5.0-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52426",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "expat: recursive XML entity expansion vulnerability",
"Description": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.",
"Severity": "LOW",
"CweIDs": [
"CWE-776"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-52426",
"https://cwe.mitre.org/data/definitions/776.html",
"https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404",
"https://github.com/libexpat/libexpat/pull/777",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-52426",
"https://security.netapp.com/advisory/ntap-20240307-0005/",
"https://www.cve.org/CVERecord?id=CVE-2023-52426"
],
"PublishedDate": "2024-02-04T20:15:46.12Z",
"LastModifiedDate": "2024-11-21T08:39:43.64Z"
},
{
"VulnerabilityID": "CVE-2024-28757",
"PkgID": "libexpat1@2.5.0-1+deb12u1",
"PkgName": "libexpat1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "de8a0c0c9f928741"
},
"InstalledVersion": "2.5.0-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28757",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "expat: XML Entity Expansion",
"Description": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).",
"Severity": "LOW",
"CweIDs": [
"CWE-776"
],
"VendorSeverity": {
"alma": 2,
"amazon": 3,
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/03/15/1",
"https://access.redhat.com/errata/RHSA-2024:1530",
"https://access.redhat.com/security/cve/CVE-2024-28757",
"https://bugzilla.redhat.com/2262877",
"https://bugzilla.redhat.com/2268766",
"https://errata.almalinux.org/9/ALSA-2024-1530.html",
"https://github.com/libexpat/libexpat/issues/839",
"https://github.com/libexpat/libexpat/pull/842",
"https://linux.oracle.com/cve/CVE-2024-28757.html",
"https://linux.oracle.com/errata/ELSA-2024-1530.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/",
"https://nvd.nist.gov/vuln/detail/CVE-2024-28757",
"https://security.netapp.com/advisory/ntap-20240322-0001/",
"https://ubuntu.com/security/notices/USN-6694-1",
"https://www.cve.org/CVERecord?id=CVE-2024-28757"
],
"PublishedDate": "2024-03-10T05:15:06.57Z",
"LastModifiedDate": "2025-03-28T19:15:21.23Z"
},
{
"VulnerabilityID": "CVE-2022-27943",
"PkgID": "libgcc-s1@12.2.0-14",
"PkgName": "libgcc-s1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgcc-s1@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "b286857ae84ea462"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const",
"Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"amazon": 1,
"debian": 1,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-27943",
"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead",
"https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-27943",
"https://sourceware.org/bugzilla/show_bug.cgi?id=28995",
"https://www.cve.org/CVERecord?id=CVE-2022-27943"
],
"PublishedDate": "2022-03-26T13:15:07.9Z",
"LastModifiedDate": "2024-11-21T06:56:31.04Z"
},
{
"VulnerabilityID": "CVE-2023-4039",
"PkgID": "libgcc-s1@12.2.0-14",
"PkgName": "libgcc-s1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgcc-s1@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "b286857ae84ea462"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64",
"Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
"Severity": "LOW",
"CweIDs": [
"CWE-693"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"oracle-oval": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-4039",
"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64",
"https://gcc.gnu.org/git/?p=gcc.git;a=blob_plain;f=SECURITY.txt",
"https://gcc.gnu.org/pipermail/gcc-patches/2023-October/634066.html",
"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf",
"https://inbox.sourceware.org/gcc-patches/46cfa37b-56eb-344d-0745-e0d35393392d@gotplt.org",
"https://linux.oracle.com/cve/CVE-2023-4039.html",
"https://linux.oracle.com/errata/ELSA-2023-28766.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4039",
"https://rtx.meta.security/mitigation/2023/09/12/CVE-2023-4039.html",
"https://www.cve.org/CVERecord?id=CVE-2023-4039"
],
"PublishedDate": "2023-09-13T09:15:15.69Z",
"LastModifiedDate": "2025-02-13T17:17:14.717Z"
},
{
"VulnerabilityID": "CVE-2018-6829",
"PkgID": "libgcrypt20@1.10.1-3",
"PkgName": "libgcrypt20",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3?arch=amd64\u0026distro=debian-12.10",
"UID": "14d13b47811260d3"
},
"InstalledVersion": "1.10.1-3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-6829",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing to obtain sensitive information",
"Description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.",
"Severity": "LOW",
"CweIDs": [
"CWE-327"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 5.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2018-6829",
"https://github.com/weikengchen/attack-on-libgcrypt-elgamal",
"https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki",
"https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html",
"https://nvd.nist.gov/vuln/detail/CVE-2018-6829",
"https://www.cve.org/CVERecord?id=CVE-2018-6829",
"https://www.oracle.com/security-alerts/cpujan2020.html"
],
"PublishedDate": "2018-02-07T23:29:01.703Z",
"LastModifiedDate": "2024-11-21T04:11:15.41Z"
},
{
"VulnerabilityID": "CVE-2024-2236",
"PkgID": "libgcrypt20@1.10.1-3",
"PkgName": "libgcrypt20",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3?arch=amd64\u0026distro=debian-12.10",
"UID": "14d13b47811260d3"
},
"InstalledVersion": "1.10.1-3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-2236",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libgcrypt: vulnerable to Marvin Attack",
"Description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.",
"Severity": "LOW",
"CweIDs": [
"CWE-208"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"debian": 1,
"oracle-oval": 2,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9404",
"https://access.redhat.com/errata/RHSA-2025:3530",
"https://access.redhat.com/errata/RHSA-2025:3534",
"https://access.redhat.com/security/cve/CVE-2024-2236",
"https://bugzilla.redhat.com/2245218",
"https://bugzilla.redhat.com/show_bug.cgi?id=2245218",
"https://bugzilla.redhat.com/show_bug.cgi?id=2268268",
"https://dev.gnupg.org/T7136",
"https://errata.almalinux.org/9/ALSA-2024-9404.html",
"https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt",
"https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17",
"https://linux.oracle.com/cve/CVE-2024-2236.html",
"https://linux.oracle.com/errata/ELSA-2024-9404.html",
"https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-2236",
"https://www.cve.org/CVERecord?id=CVE-2024-2236"
],
"PublishedDate": "2024-03-06T22:15:57.977Z",
"LastModifiedDate": "2025-04-02T17:15:37.79Z"
},
{
"VulnerabilityID": "CVE-2011-3389",
"PkgID": "libgnutls30@3.7.9-2+deb12u4",
"PkgName": "libgnutls30",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.10",
"UID": "43b99bda745a9f24"
},
"InstalledVersion": "3.7.9-2+deb12u4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3389",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)",
"Description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.",
"Severity": "LOW",
"CweIDs": [
"CWE-326"
],
"VendorSeverity": {
"amazon": 4,
"debian": 1,
"nvd": 2,
"oracle-oval": 4,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"V2Score": 4.3
},
"redhat": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"V2Score": 4.3
}
},
"References": [
"http://arcticdog.wordpress.com/2012/08/29/beast-openssl-and-apache/",
"http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/",
"http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx",
"http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx",
"http://curl.haxx.se/docs/adv_20120124B.html",
"http://downloads.asterisk.org/pub/security/AST-2016-001.html",
"http://ekoparty.org/2011/juliano-rizzo.php",
"http://eprint.iacr.org/2004/111",
"http://eprint.iacr.org/2006/136",
"http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html",
"http://isc.sans.edu/diary/SSL+TLS+part+3+/11635",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html",
"http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html",
"http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html",
"http://lists.apple.com/archives/security-announce/2012/May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
"http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2",
"http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue",
"http://osvdb.org/74829",
"http://rhn.redhat.com/errata/RHSA-2012-0508.html",
"http://rhn.redhat.com/errata/RHSA-2013-1455.html",
"http://secunia.com/advisories/45791",
"http://secunia.com/advisories/47998",
"http://secunia.com/advisories/48256",
"http://secunia.com/advisories/48692",
"http://secunia.com/advisories/48915",
"http://secunia.com/advisories/48948",
"http://secunia.com/advisories/49198",
"http://secunia.com/advisories/55322",
"http://secunia.com/advisories/55350",
"http://secunia.com/advisories/55351",
"http://security.gentoo.org/glsa/glsa-201203-02.xml",
"http://security.gentoo.org/glsa/glsa-201406-32.xml",
"http://support.apple.com/kb/HT4999",
"http://support.apple.com/kb/HT5001",
"http://support.apple.com/kb/HT5130",
"http://support.apple.com/kb/HT5281",
"http://support.apple.com/kb/HT5501",
"http://support.apple.com/kb/HT6150",
"http://technet.microsoft.com/security/advisory/2588513",
"http://vnhacker.blogspot.com/2011/09/beast.html",
"http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf",
"http://www.debian.org/security/2012/dsa-2398",
"http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html",
"http://www.ibm.com/developerworks/java/jdk/alerts/",
"http://www.imperialviolet.org/2011/09/23/chromeandbeast.html",
"http://www.insecure.cl/Beast-SSL.rar",
"http://www.kb.cert.org/vuls/id/864643",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:058",
"http://www.opera.com/docs/changelogs/mac/1151/",
"http://www.opera.com/docs/changelogs/mac/1160/",
"http://www.opera.com/docs/changelogs/unix/1151/",
"http://www.opera.com/docs/changelogs/unix/1160/",
"http://www.opera.com/docs/changelogs/windows/1151/",
"http://www.opera.com/docs/changelogs/windows/1160/",
"http://www.opera.com/support/kb/view/1004/",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html",
"http://www.redhat.com/support/errata/RHSA-2011-1384.html",
"http://www.redhat.com/support/errata/RHSA-2012-0006.html",
"http://www.securityfocus.com/bid/49388",
"http://www.securityfocus.com/bid/49778",
"http://www.securitytracker.com/id/1029190",
"http://www.securitytracker.com/id?1025997",
"http://www.securitytracker.com/id?1026103",
"http://www.securitytracker.com/id?1026704",
"http://www.ubuntu.com/usn/USN-1263-1",
"http://www.us-cert.gov/cas/techalerts/TA12-010A.html",
"https://access.redhat.com/security/cve/CVE-2011-3389",
"https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail",
"https://bugzilla.novell.com/show_bug.cgi?id=719047",
"https://bugzilla.redhat.com/show_bug.cgi?id=737506",
"https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf",
"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006",
"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862",
"https://hermes.opensuse.org/messages/13154861",
"https://hermes.opensuse.org/messages/13155432",
"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
"https://linux.oracle.com/cve/CVE-2011-3389.html",
"https://linux.oracle.com/errata/ELSA-2011-1380.html",
"https://nvd.nist.gov/vuln/detail/CVE-2011-3389",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752",
"https://ubuntu.com/security/notices/USN-1263-1",
"https://www.cve.org/CVERecord?id=CVE-2011-3389"
],
"PublishedDate": "2011-09-06T19:55:03.197Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2024-26462",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26462",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/kdc/ndr.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-401"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26462",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md",
"https://linux.oracle.com/cve/CVE-2024-26462.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26462",
"https://security.netapp.com/advisory/ntap-20240415-0012/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26462"
],
"PublishedDate": "2024-02-29T01:44:18.857Z",
"LastModifiedDate": "2025-03-25T20:15:21.143Z"
},
{
"VulnerabilityID": "CVE-2025-24528",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-24528",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: overflow when calculating ulog block size",
"Description": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"oracle-oval": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2722",
"https://access.redhat.com/security/cve/CVE-2025-24528",
"https://bugzilla.redhat.com/2342796",
"https://errata.almalinux.org/8/ALSA-2025-2722.html",
"https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"https://linux.oracle.com/cve/CVE-2025-24528.html",
"https://linux.oracle.com/errata/ELSA-2025-2722.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2025-24528"
]
},
{
"VulnerabilityID": "CVE-2025-3576",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-3576",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions",
"Description": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-328"
],
"VendorSeverity": {
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-3576",
"https://bugzilla.redhat.com/show_bug.cgi?id=2359465",
"https://nvd.nist.gov/vuln/detail/CVE-2025-3576",
"https://www.cve.org/CVERecord?id=CVE-2025-3576"
],
"PublishedDate": "2025-04-15T06:15:44.047Z",
"LastModifiedDate": "2025-04-15T18:39:27.967Z"
},
{
"VulnerabilityID": "CVE-2018-5709",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c",
"Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
"Severity": "LOW",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"V3Score": 6.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2018-5709",
"https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2018-5709",
"https://www.cve.org/CVERecord?id=CVE-2018-5709"
],
"PublishedDate": "2018-01-16T09:29:00.5Z",
"LastModifiedDate": "2024-11-21T04:09:13.037Z"
},
{
"VulnerabilityID": "CVE-2024-26458",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
"Severity": "LOW",
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26458",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md",
"https://linux.oracle.com/cve/CVE-2024-26458.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26458",
"https://security.netapp.com/advisory/ntap-20240415-0010/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26458"
],
"PublishedDate": "2024-02-29T01:44:18.78Z",
"LastModifiedDate": "2024-12-06T21:15:06.28Z"
},
{
"VulnerabilityID": "CVE-2024-26461",
"PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u2",
"PkgName": "libgssapi-krb5-2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a766fc6f5729a82a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-770"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26461",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md",
"https://linux.oracle.com/cve/CVE-2024-26461.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26461",
"https://security.netapp.com/advisory/ntap-20240415-0011/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26461"
],
"PublishedDate": "2024-02-29T01:44:18.82Z",
"LastModifiedDate": "2024-11-21T09:02:26.477Z"
},
{
"VulnerabilityID": "CVE-2023-49463",
"PkgID": "libheif1@1.15.1-1+deb12u1",
"PkgName": "libheif1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libheif1@1.15.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "4eb53d0aa669a22c"
},
"InstalledVersion": "1.15.1-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49463",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libheif v1.17.5 was discovered to contain a segmentation violation via ...",
"Description": "libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 8.8
}
},
"References": [
"https://github.com/strukturag/libheif",
"https://github.com/strukturag/libheif/issues/1042",
"https://ubuntu.com/security/notices/USN-6847-1",
"https://www.cve.org/CVERecord?id=CVE-2023-49463"
],
"PublishedDate": "2023-12-07T20:15:38.26Z",
"LastModifiedDate": "2024-11-21T08:33:26.393Z"
},
{
"VulnerabilityID": "CVE-2024-25269",
"PkgID": "libheif1@1.15.1-1+deb12u1",
"PkgName": "libheif1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libheif1@1.15.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "4eb53d0aa669a22c"
},
"InstalledVersion": "1.15.1-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-25269",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libheif \u003c= 1.17.6 contains a memory leak in the function JpegEncoder:: ...",
"Description": "libheif \u003c= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.",
"Severity": "LOW",
"CweIDs": [
"CWE-400"
],
"VendorSeverity": {
"debian": 1
},
"References": [
"https://github.com/strukturag/libheif/issues/1073"
],
"PublishedDate": "2024-03-05T01:15:06.78Z",
"LastModifiedDate": "2025-03-24T14:40:29.34Z"
},
{
"VulnerabilityID": "CVE-2025-43966",
"PkgID": "libheif1@1.15.1-1+deb12u1",
"PkgName": "libheif1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libheif1@1.15.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "4eb53d0aa669a22c"
},
"InstalledVersion": "1.15.1-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-43966",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden ...",
"Description": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.",
"Severity": "UNKNOWN",
"CweIDs": [
"CWE-476"
],
"References": [
"https://github.com/strukturag/libheif/commit/b38555387e4b5dcf036fe45b0c440aca19b7b69c",
"https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6"
],
"PublishedDate": "2025-04-21T00:15:33.457Z",
"LastModifiedDate": "2025-04-21T14:23:45.95Z"
},
{
"VulnerabilityID": "CVE-2025-43967",
"PkgID": "libheif1@1.15.1-1+deb12u1",
"PkgName": "libheif1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libheif1@1.15.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "4eb53d0aa669a22c"
},
"InstalledVersion": "1.15.1-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-43967",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid ...",
"Description": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.",
"Severity": "UNKNOWN",
"CweIDs": [
"CWE-476"
],
"References": [
"https://github.com/strukturag/libheif/commit/6e35af7b0ff9fb6cc952a1539590d160db32f671",
"https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6",
"https://github.com/strukturag/libheif/issues/1455"
],
"PublishedDate": "2025-04-21T00:15:33.607Z",
"LastModifiedDate": "2025-04-21T14:23:45.95Z"
},
{
"VulnerabilityID": "CVE-2017-9937",
"PkgID": "libjbig0@2.1-6.1",
"PkgName": "libjbig0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libjbig0@2.1-6.1?arch=amd64\u0026distro=debian-12.10",
"UID": "485e07103432caa0"
},
"InstalledVersion": "2.1-6.1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-9937",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: memory malloc failure in tif_jbig.c could cause DOS.",
"Description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.",
"Severity": "LOW",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 3.3
}
},
"References": [
"http://bugzilla.maptools.org/show_bug.cgi?id=2707",
"http://www.securityfocus.com/bid/99304",
"https://access.redhat.com/security/cve/CVE-2017-9937",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2017-9937",
"https://ubuntu.com/security/notices/USN-5742-1",
"https://www.cve.org/CVERecord?id=CVE-2017-9937"
],
"PublishedDate": "2017-06-26T12:29:00.25Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2024-26462",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26462",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/kdc/ndr.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-401"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26462",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md",
"https://linux.oracle.com/cve/CVE-2024-26462.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26462",
"https://security.netapp.com/advisory/ntap-20240415-0012/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26462"
],
"PublishedDate": "2024-02-29T01:44:18.857Z",
"LastModifiedDate": "2025-03-25T20:15:21.143Z"
},
{
"VulnerabilityID": "CVE-2025-24528",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-24528",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: overflow when calculating ulog block size",
"Description": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"oracle-oval": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2722",
"https://access.redhat.com/security/cve/CVE-2025-24528",
"https://bugzilla.redhat.com/2342796",
"https://errata.almalinux.org/8/ALSA-2025-2722.html",
"https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"https://linux.oracle.com/cve/CVE-2025-24528.html",
"https://linux.oracle.com/errata/ELSA-2025-2722.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2025-24528"
]
},
{
"VulnerabilityID": "CVE-2025-3576",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-3576",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions",
"Description": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-328"
],
"VendorSeverity": {
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-3576",
"https://bugzilla.redhat.com/show_bug.cgi?id=2359465",
"https://nvd.nist.gov/vuln/detail/CVE-2025-3576",
"https://www.cve.org/CVERecord?id=CVE-2025-3576"
],
"PublishedDate": "2025-04-15T06:15:44.047Z",
"LastModifiedDate": "2025-04-15T18:39:27.967Z"
},
{
"VulnerabilityID": "CVE-2018-5709",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c",
"Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
"Severity": "LOW",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"V3Score": 6.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2018-5709",
"https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2018-5709",
"https://www.cve.org/CVERecord?id=CVE-2018-5709"
],
"PublishedDate": "2018-01-16T09:29:00.5Z",
"LastModifiedDate": "2024-11-21T04:09:13.037Z"
},
{
"VulnerabilityID": "CVE-2024-26458",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
"Severity": "LOW",
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26458",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md",
"https://linux.oracle.com/cve/CVE-2024-26458.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26458",
"https://security.netapp.com/advisory/ntap-20240415-0010/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26458"
],
"PublishedDate": "2024-02-29T01:44:18.78Z",
"LastModifiedDate": "2024-12-06T21:15:06.28Z"
},
{
"VulnerabilityID": "CVE-2024-26461",
"PkgID": "libk5crypto3@1.20.1-2+deb12u2",
"PkgName": "libk5crypto3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "a6385e8d146138e3"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-770"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26461",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md",
"https://linux.oracle.com/cve/CVE-2024-26461.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26461",
"https://security.netapp.com/advisory/ntap-20240415-0011/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26461"
],
"PublishedDate": "2024-02-29T01:44:18.82Z",
"LastModifiedDate": "2024-11-21T09:02:26.477Z"
},
{
"VulnerabilityID": "CVE-2024-26462",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26462",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/kdc/ndr.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-401"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26462",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md",
"https://linux.oracle.com/cve/CVE-2024-26462.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26462",
"https://security.netapp.com/advisory/ntap-20240415-0012/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26462"
],
"PublishedDate": "2024-02-29T01:44:18.857Z",
"LastModifiedDate": "2025-03-25T20:15:21.143Z"
},
{
"VulnerabilityID": "CVE-2025-24528",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-24528",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: overflow when calculating ulog block size",
"Description": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"oracle-oval": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2722",
"https://access.redhat.com/security/cve/CVE-2025-24528",
"https://bugzilla.redhat.com/2342796",
"https://errata.almalinux.org/8/ALSA-2025-2722.html",
"https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"https://linux.oracle.com/cve/CVE-2025-24528.html",
"https://linux.oracle.com/errata/ELSA-2025-2722.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2025-24528"
]
},
{
"VulnerabilityID": "CVE-2025-3576",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-3576",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions",
"Description": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-328"
],
"VendorSeverity": {
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-3576",
"https://bugzilla.redhat.com/show_bug.cgi?id=2359465",
"https://nvd.nist.gov/vuln/detail/CVE-2025-3576",
"https://www.cve.org/CVERecord?id=CVE-2025-3576"
],
"PublishedDate": "2025-04-15T06:15:44.047Z",
"LastModifiedDate": "2025-04-15T18:39:27.967Z"
},
{
"VulnerabilityID": "CVE-2018-5709",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c",
"Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
"Severity": "LOW",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"V3Score": 6.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2018-5709",
"https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2018-5709",
"https://www.cve.org/CVERecord?id=CVE-2018-5709"
],
"PublishedDate": "2018-01-16T09:29:00.5Z",
"LastModifiedDate": "2024-11-21T04:09:13.037Z"
},
{
"VulnerabilityID": "CVE-2024-26458",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
"Severity": "LOW",
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26458",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md",
"https://linux.oracle.com/cve/CVE-2024-26458.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26458",
"https://security.netapp.com/advisory/ntap-20240415-0010/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26458"
],
"PublishedDate": "2024-02-29T01:44:18.78Z",
"LastModifiedDate": "2024-12-06T21:15:06.28Z"
},
{
"VulnerabilityID": "CVE-2024-26461",
"PkgID": "libkrb5-3@1.20.1-2+deb12u2",
"PkgName": "libkrb5-3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "84bd54cf04d783a"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-770"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26461",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md",
"https://linux.oracle.com/cve/CVE-2024-26461.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26461",
"https://security.netapp.com/advisory/ntap-20240415-0011/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26461"
],
"PublishedDate": "2024-02-29T01:44:18.82Z",
"LastModifiedDate": "2024-11-21T09:02:26.477Z"
},
{
"VulnerabilityID": "CVE-2024-26462",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26462",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/kdc/ndr.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-401"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26462",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md",
"https://linux.oracle.com/cve/CVE-2024-26462.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26462",
"https://security.netapp.com/advisory/ntap-20240415-0012/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26462"
],
"PublishedDate": "2024-02-29T01:44:18.857Z",
"LastModifiedDate": "2025-03-25T20:15:21.143Z"
},
{
"VulnerabilityID": "CVE-2025-24528",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-24528",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: overflow when calculating ulog block size",
"Description": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"oracle-oval": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2722",
"https://access.redhat.com/security/cve/CVE-2025-24528",
"https://bugzilla.redhat.com/2342796",
"https://errata.almalinux.org/8/ALSA-2025-2722.html",
"https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"https://linux.oracle.com/cve/CVE-2025-24528.html",
"https://linux.oracle.com/errata/ELSA-2025-2722.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2025-24528"
]
},
{
"VulnerabilityID": "CVE-2025-3576",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-3576",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions",
"Description": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-328"
],
"VendorSeverity": {
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-3576",
"https://bugzilla.redhat.com/show_bug.cgi?id=2359465",
"https://nvd.nist.gov/vuln/detail/CVE-2025-3576",
"https://www.cve.org/CVERecord?id=CVE-2025-3576"
],
"PublishedDate": "2025-04-15T06:15:44.047Z",
"LastModifiedDate": "2025-04-15T18:39:27.967Z"
},
{
"VulnerabilityID": "CVE-2018-5709",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c",
"Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
"Severity": "LOW",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"V3Score": 6.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2018-5709",
"https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2018-5709",
"https://www.cve.org/CVERecord?id=CVE-2018-5709"
],
"PublishedDate": "2018-01-16T09:29:00.5Z",
"LastModifiedDate": "2024-11-21T04:09:13.037Z"
},
{
"VulnerabilityID": "CVE-2024-26458",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
"Severity": "LOW",
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26458",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md",
"https://linux.oracle.com/cve/CVE-2024-26458.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26458",
"https://security.netapp.com/advisory/ntap-20240415-0010/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26458"
],
"PublishedDate": "2024-02-29T01:44:18.78Z",
"LastModifiedDate": "2024-12-06T21:15:06.28Z"
},
{
"VulnerabilityID": "CVE-2024-26461",
"PkgID": "libkrb5support0@1.20.1-2+deb12u2",
"PkgName": "libkrb5support0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "9d869b6ab3b3ff5b"
},
"InstalledVersion": "1.20.1-2+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c",
"Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-770"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 3,
"cbl-mariner": 3,
"debian": 1,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:9331",
"https://access.redhat.com/security/cve/CVE-2024-26461",
"https://bugzilla.redhat.com/2266731",
"https://bugzilla.redhat.com/2266740",
"https://bugzilla.redhat.com/2266742",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266731",
"https://bugzilla.redhat.com/show_bug.cgi?id=2266740",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461",
"https://errata.almalinux.org/9/ALSA-2024-9331.html",
"https://errata.rockylinux.org/RLSA-2024:3268",
"https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md",
"https://linux.oracle.com/cve/CVE-2024-26461.html",
"https://linux.oracle.com/errata/ELSA-2024-9331.html",
"https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26461",
"https://security.netapp.com/advisory/ntap-20240415-0011/",
"https://ubuntu.com/security/notices/USN-7314-1",
"https://www.cve.org/CVERecord?id=CVE-2024-26461"
],
"PublishedDate": "2024-02-29T01:44:18.82Z",
"LastModifiedDate": "2024-11-21T09:02:26.477Z"
},
{
"VulnerabilityID": "CVE-2023-2953",
"PkgID": "libldap-2.5-0@2.5.13+dfsg-5",
"PkgName": "libldap-2.5-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.10",
"UID": "b9bd1cf03a5819bf"
},
"InstalledVersion": "2.5.13+dfsg-5",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-2953",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openldap: null pointer dereference in ber_memalloc_x function",
"Description": "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
"Severity": "HIGH",
"CweIDs": [
"CWE-476"
],
"VendorSeverity": {
"alma": 1,
"amazon": 2,
"bitnami": 3,
"cbl-mariner": 3,
"nvd": 3,
"oracle-oval": 1,
"photon": 3,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"V3Score": 7.1
}
},
"References": [
"http://seclists.org/fulldisclosure/2023/Jul/47",
"http://seclists.org/fulldisclosure/2023/Jul/48",
"http://seclists.org/fulldisclosure/2023/Jul/52",
"https://access.redhat.com/errata/RHSA-2024:4264",
"https://access.redhat.com/security/cve/CVE-2023-2953",
"https://bugs.openldap.org/show_bug.cgi?id=9904",
"https://bugzilla.redhat.com/2210651",
"https://errata.almalinux.org/8/ALSA-2024-4264.html",
"https://linux.oracle.com/cve/CVE-2023-2953.html",
"https://linux.oracle.com/errata/ELSA-2024-4264.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-2953",
"https://security.netapp.com/advisory/ntap-20230703-0005/",
"https://support.apple.com/kb/HT213843",
"https://support.apple.com/kb/HT213844",
"https://support.apple.com/kb/HT213845",
"https://ubuntu.com/security/notices/USN-6197-1",
"https://ubuntu.com/security/notices/USN-6616-1",
"https://www.cve.org/CVERecord?id=CVE-2023-2953"
],
"PublishedDate": "2023-05-30T22:15:10.613Z",
"LastModifiedDate": "2025-01-10T22:15:23.557Z"
},
{
"VulnerabilityID": "CVE-2015-3276",
"PkgID": "libldap-2.5-0@2.5.13+dfsg-5",
"PkgName": "libldap-2.5-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.10",
"UID": "b9bd1cf03a5819bf"
},
"InstalledVersion": "2.5.13+dfsg-5",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-3276",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openldap: incorrect multi-keyword mode cipherstring parsing",
"Description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.",
"Severity": "LOW",
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"oracle-oval": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"V2Score": 4.3
}
},
"References": [
"http://rhn.redhat.com/errata/RHSA-2015-2131.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
"http://www.securitytracker.com/id/1034221",
"https://access.redhat.com/security/cve/CVE-2015-3276",
"https://bugzilla.redhat.com/show_bug.cgi?id=1238322",
"https://linux.oracle.com/cve/CVE-2015-3276.html",
"https://linux.oracle.com/errata/ELSA-2015-2131.html",
"https://nvd.nist.gov/vuln/detail/CVE-2015-3276",
"https://www.cve.org/CVERecord?id=CVE-2015-3276"
],
"PublishedDate": "2015-12-07T20:59:03.023Z",
"LastModifiedDate": "2025-04-12T10:46:40.837Z"
},
{
"VulnerabilityID": "CVE-2017-14159",
"PkgID": "libldap-2.5-0@2.5.13+dfsg-5",
"PkgName": "libldap-2.5-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.10",
"UID": "b9bd1cf03a5819bf"
},
"InstalledVersion": "2.5.13+dfsg-5",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-14159",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openldap: Privilege escalation via PID file manipulation",
"Description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.",
"Severity": "LOW",
"CweIDs": [
"CWE-665"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 1.9,
"V3Score": 4.7
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 4.4
}
},
"References": [
"http://www.openldap.org/its/index.cgi?findid=8703",
"https://access.redhat.com/security/cve/CVE-2017-14159",
"https://nvd.nist.gov/vuln/detail/CVE-2017-14159",
"https://www.cve.org/CVERecord?id=CVE-2017-14159",
"https://www.oracle.com/security-alerts/cpuapr2022.html"
],
"PublishedDate": "2017-09-05T18:29:00.133Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2017-17740",
"PkgID": "libldap-2.5-0@2.5.13+dfsg-5",
"PkgName": "libldap-2.5-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.10",
"UID": "b9bd1cf03a5819bf"
},
"InstalledVersion": "2.5.13+dfsg-5",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-17740",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of service",
"Description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.",
"Severity": "LOW",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html",
"http://www.openldap.org/its/index.cgi/Incoming?id=8759",
"https://access.redhat.com/security/cve/CVE-2017-17740",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://nvd.nist.gov/vuln/detail/CVE-2017-17740",
"https://www.cve.org/CVERecord?id=CVE-2017-17740",
"https://www.oracle.com/security-alerts/cpuapr2022.html"
],
"PublishedDate": "2017-12-18T06:29:00.397Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2020-15719",
"PkgID": "libldap-2.5-0@2.5.13+dfsg-5",
"PkgName": "libldap-2.5-0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.10",
"UID": "b9bd1cf03a5819bf"
},
"InstalledVersion": "2.5.13+dfsg-5",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-15719",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openldap: Certificate validation incorrectly matches name against CN-ID",
"Description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.",
"Severity": "LOW",
"CweIDs": [
"CWE-295"
],
"VendorSeverity": {
"bitnami": 2,
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"V3Score": 4.2
},
"nvd": {
"V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"V2Score": 4,
"V3Score": 4.2
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"V3Score": 4.2
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html",
"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html",
"https://access.redhat.com/errata/RHBA-2019:3674",
"https://access.redhat.com/security/cve/CVE-2020-15719",
"https://bugs.openldap.org/show_bug.cgi?id=9266",
"https://bugzilla.redhat.com/show_bug.cgi?id=1740070",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://nvd.nist.gov/vuln/detail/CVE-2020-15719",
"https://www.cve.org/CVERecord?id=CVE-2020-15719",
"https://www.oracle.com/security-alerts/cpuapr2022.html"
],
"PublishedDate": "2020-07-14T14:15:17.667Z",
"LastModifiedDate": "2024-11-21T05:06:05.903Z"
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "libmount1@2.38.1-5+deb12u3",
"PkgName": "libmount1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "6ebca51aff38e6ce"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2024-10041",
"PkgID": "libpam-modules@1.5.2-6+deb12u1",
"PkgName": "libpam-modules",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "854c4c35b318f724"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: libpam: Libpam vulnerable to read hashed password",
"Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-922"
],
"VendorSeverity": {
"alma": 2,
"azure": 2,
"cbl-mariner": 2,
"oracle-oval": 2,
"redhat": 2,
"rocky": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:10379",
"https://access.redhat.com/errata/RHSA-2024:11250",
"https://access.redhat.com/errata/RHSA-2024:9941",
"https://access.redhat.com/security/cve/CVE-2024-10041",
"https://bugzilla.redhat.com/2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2324291",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963",
"https://errata.almalinux.org/9/ALSA-2024-11250.html",
"https://errata.rockylinux.org/RLSA-2024:10379",
"https://linux.oracle.com/cve/CVE-2024-10041.html",
"https://linux.oracle.com/errata/ELSA-2024-11250.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-10041",
"https://www.cve.org/CVERecord?id=CVE-2024-10041"
],
"PublishedDate": "2024-10-23T14:15:03.97Z",
"LastModifiedDate": "2024-12-18T10:15:05.85Z"
},
{
"VulnerabilityID": "CVE-2024-22365",
"PkgID": "libpam-modules@1.5.2-6+deb12u1",
"PkgName": "libpam-modules",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "854c4c35b318f724"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-22365",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: allowing unprivileged user to block another user namespace",
"Description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"amazon": 1,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/01/18/3",
"https://access.redhat.com/errata/RHSA-2024:2438",
"https://access.redhat.com/security/cve/CVE-2024-22365",
"https://bugzilla.redhat.com/2257722",
"https://bugzilla.redhat.com/show_bug.cgi?id=2257722",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22365",
"https://errata.almalinux.org/9/ALSA-2024-2438.html",
"https://errata.rockylinux.org/RLSA-2024:3163",
"https://github.com/linux-pam/linux-pam",
"https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb",
"https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0",
"https://linux.oracle.com/cve/CVE-2024-22365.html",
"https://linux.oracle.com/errata/ELSA-2024-3163.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-22365",
"https://ubuntu.com/security/notices/USN-6588-1",
"https://ubuntu.com/security/notices/USN-6588-2",
"https://www.cve.org/CVERecord?id=CVE-2024-22365",
"https://www.openwall.com/lists/oss-security/2024/01/18/3"
],
"PublishedDate": "2024-02-06T08:15:52.203Z",
"LastModifiedDate": "2024-11-21T08:56:07.76Z"
},
{
"VulnerabilityID": "CVE-2024-10041",
"PkgID": "libpam-modules-bin@1.5.2-6+deb12u1",
"PkgName": "libpam-modules-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "6e01953a38b979ef"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: libpam: Libpam vulnerable to read hashed password",
"Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-922"
],
"VendorSeverity": {
"alma": 2,
"azure": 2,
"cbl-mariner": 2,
"oracle-oval": 2,
"redhat": 2,
"rocky": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:10379",
"https://access.redhat.com/errata/RHSA-2024:11250",
"https://access.redhat.com/errata/RHSA-2024:9941",
"https://access.redhat.com/security/cve/CVE-2024-10041",
"https://bugzilla.redhat.com/2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2324291",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963",
"https://errata.almalinux.org/9/ALSA-2024-11250.html",
"https://errata.rockylinux.org/RLSA-2024:10379",
"https://linux.oracle.com/cve/CVE-2024-10041.html",
"https://linux.oracle.com/errata/ELSA-2024-11250.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-10041",
"https://www.cve.org/CVERecord?id=CVE-2024-10041"
],
"PublishedDate": "2024-10-23T14:15:03.97Z",
"LastModifiedDate": "2024-12-18T10:15:05.85Z"
},
{
"VulnerabilityID": "CVE-2024-22365",
"PkgID": "libpam-modules-bin@1.5.2-6+deb12u1",
"PkgName": "libpam-modules-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "6e01953a38b979ef"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-22365",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: allowing unprivileged user to block another user namespace",
"Description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"amazon": 1,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/01/18/3",
"https://access.redhat.com/errata/RHSA-2024:2438",
"https://access.redhat.com/security/cve/CVE-2024-22365",
"https://bugzilla.redhat.com/2257722",
"https://bugzilla.redhat.com/show_bug.cgi?id=2257722",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22365",
"https://errata.almalinux.org/9/ALSA-2024-2438.html",
"https://errata.rockylinux.org/RLSA-2024:3163",
"https://github.com/linux-pam/linux-pam",
"https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb",
"https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0",
"https://linux.oracle.com/cve/CVE-2024-22365.html",
"https://linux.oracle.com/errata/ELSA-2024-3163.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-22365",
"https://ubuntu.com/security/notices/USN-6588-1",
"https://ubuntu.com/security/notices/USN-6588-2",
"https://www.cve.org/CVERecord?id=CVE-2024-22365",
"https://www.openwall.com/lists/oss-security/2024/01/18/3"
],
"PublishedDate": "2024-02-06T08:15:52.203Z",
"LastModifiedDate": "2024-11-21T08:56:07.76Z"
},
{
"VulnerabilityID": "CVE-2024-10041",
"PkgID": "libpam-runtime@1.5.2-6+deb12u1",
"PkgName": "libpam-runtime",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u1?arch=all\u0026distro=debian-12.10",
"UID": "a4ba3bc9ed7e203b"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: libpam: Libpam vulnerable to read hashed password",
"Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-922"
],
"VendorSeverity": {
"alma": 2,
"azure": 2,
"cbl-mariner": 2,
"oracle-oval": 2,
"redhat": 2,
"rocky": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:10379",
"https://access.redhat.com/errata/RHSA-2024:11250",
"https://access.redhat.com/errata/RHSA-2024:9941",
"https://access.redhat.com/security/cve/CVE-2024-10041",
"https://bugzilla.redhat.com/2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2324291",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963",
"https://errata.almalinux.org/9/ALSA-2024-11250.html",
"https://errata.rockylinux.org/RLSA-2024:10379",
"https://linux.oracle.com/cve/CVE-2024-10041.html",
"https://linux.oracle.com/errata/ELSA-2024-11250.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-10041",
"https://www.cve.org/CVERecord?id=CVE-2024-10041"
],
"PublishedDate": "2024-10-23T14:15:03.97Z",
"LastModifiedDate": "2024-12-18T10:15:05.85Z"
},
{
"VulnerabilityID": "CVE-2024-22365",
"PkgID": "libpam-runtime@1.5.2-6+deb12u1",
"PkgName": "libpam-runtime",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u1?arch=all\u0026distro=debian-12.10",
"UID": "a4ba3bc9ed7e203b"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-22365",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: allowing unprivileged user to block another user namespace",
"Description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"amazon": 1,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/01/18/3",
"https://access.redhat.com/errata/RHSA-2024:2438",
"https://access.redhat.com/security/cve/CVE-2024-22365",
"https://bugzilla.redhat.com/2257722",
"https://bugzilla.redhat.com/show_bug.cgi?id=2257722",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22365",
"https://errata.almalinux.org/9/ALSA-2024-2438.html",
"https://errata.rockylinux.org/RLSA-2024:3163",
"https://github.com/linux-pam/linux-pam",
"https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb",
"https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0",
"https://linux.oracle.com/cve/CVE-2024-22365.html",
"https://linux.oracle.com/errata/ELSA-2024-3163.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-22365",
"https://ubuntu.com/security/notices/USN-6588-1",
"https://ubuntu.com/security/notices/USN-6588-2",
"https://www.cve.org/CVERecord?id=CVE-2024-22365",
"https://www.openwall.com/lists/oss-security/2024/01/18/3"
],
"PublishedDate": "2024-02-06T08:15:52.203Z",
"LastModifiedDate": "2024-11-21T08:56:07.76Z"
},
{
"VulnerabilityID": "CVE-2024-10041",
"PkgID": "libpam0g@1.5.2-6+deb12u1",
"PkgName": "libpam0g",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "ceb03f98e63e7ec7"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: libpam: Libpam vulnerable to read hashed password",
"Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-922"
],
"VendorSeverity": {
"alma": 2,
"azure": 2,
"cbl-mariner": 2,
"oracle-oval": 2,
"redhat": 2,
"rocky": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:10379",
"https://access.redhat.com/errata/RHSA-2024:11250",
"https://access.redhat.com/errata/RHSA-2024:9941",
"https://access.redhat.com/security/cve/CVE-2024-10041",
"https://bugzilla.redhat.com/2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2319212",
"https://bugzilla.redhat.com/show_bug.cgi?id=2324291",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963",
"https://errata.almalinux.org/9/ALSA-2024-11250.html",
"https://errata.rockylinux.org/RLSA-2024:10379",
"https://linux.oracle.com/cve/CVE-2024-10041.html",
"https://linux.oracle.com/errata/ELSA-2024-11250.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-10041",
"https://www.cve.org/CVERecord?id=CVE-2024-10041"
],
"PublishedDate": "2024-10-23T14:15:03.97Z",
"LastModifiedDate": "2024-12-18T10:15:05.85Z"
},
{
"VulnerabilityID": "CVE-2024-22365",
"PkgID": "libpam0g@1.5.2-6+deb12u1",
"PkgName": "libpam0g",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "ceb03f98e63e7ec7"
},
"InstalledVersion": "1.5.2-6+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-22365",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "pam: allowing unprivileged user to block another user namespace",
"Description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.",
"Severity": "MEDIUM",
"VendorSeverity": {
"alma": 2,
"amazon": 1,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/01/18/3",
"https://access.redhat.com/errata/RHSA-2024:2438",
"https://access.redhat.com/security/cve/CVE-2024-22365",
"https://bugzilla.redhat.com/2257722",
"https://bugzilla.redhat.com/show_bug.cgi?id=2257722",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22365",
"https://errata.almalinux.org/9/ALSA-2024-2438.html",
"https://errata.rockylinux.org/RLSA-2024:3163",
"https://github.com/linux-pam/linux-pam",
"https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb",
"https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0",
"https://linux.oracle.com/cve/CVE-2024-22365.html",
"https://linux.oracle.com/errata/ELSA-2024-3163.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-22365",
"https://ubuntu.com/security/notices/USN-6588-1",
"https://ubuntu.com/security/notices/USN-6588-2",
"https://www.cve.org/CVERecord?id=CVE-2024-22365",
"https://www.openwall.com/lists/oss-security/2024/01/18/3"
],
"PublishedDate": "2024-02-06T08:15:52.203Z",
"LastModifiedDate": "2024-11-21T08:56:07.76Z"
},
{
"VulnerabilityID": "CVE-2021-4214",
"PkgID": "libpng16-16@1.6.39-2",
"PkgName": "libpng16-16",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libpng16-16@1.6.39-2?arch=amd64\u0026distro=debian-12.10",
"UID": "6c4f8e571f246e7"
},
"InstalledVersion": "1.6.39-2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-4214",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libpng: hardcoded value leads to heap-overflow",
"Description": "A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.",
"Severity": "LOW",
"CweIDs": [
"CWE-120",
"CWE-787"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2021-4214",
"https://bugzilla.redhat.com/show_bug.cgi?id=2043393",
"https://github.com/glennrp/libpng/issues/302",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4214",
"https://security-tracker.debian.org/tracker/CVE-2021-4214",
"https://security.netapp.com/advisory/ntap-20221020-0001/",
"https://www.cve.org/CVERecord?id=CVE-2021-4214"
],
"PublishedDate": "2022-08-24T16:15:10.037Z",
"LastModifiedDate": "2024-11-21T06:37:10.063Z"
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "libsmartcols1@2.38.1-5+deb12u3",
"PkgName": "libsmartcols1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "ccde01db134296f8"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2024-13176",
"PkgID": "libssl3@3.0.15-1~deb12u1",
"PkgName": "libssl3",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libssl3@3.0.15-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "da582553a7427034"
},
"InstalledVersion": "3.0.15-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-13176",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openssl: Timing side-channel in ECDSA signature computation",
"Description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-385"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2025/01/20/2",
"https://access.redhat.com/security/cve/CVE-2024-13176",
"https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844",
"https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467",
"https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902",
"https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65",
"https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f",
"https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded",
"https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86",
"https://nvd.nist.gov/vuln/detail/CVE-2024-13176",
"https://openssl-library.org/news/secadv/20250120.txt",
"https://security.netapp.com/advisory/ntap-20250124-0005/",
"https://security.netapp.com/advisory/ntap-20250418-0010/",
"https://ubuntu.com/security/notices/USN-7264-1",
"https://ubuntu.com/security/notices/USN-7278-1",
"https://www.cve.org/CVERecord?id=CVE-2024-13176",
"https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL"
],
"PublishedDate": "2025-01-20T14:15:26.247Z",
"LastModifiedDate": "2025-04-19T01:15:43.007Z"
},
{
"VulnerabilityID": "CVE-2022-27943",
"PkgID": "libstdc++6@12.2.0-14",
"PkgName": "libstdc++6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "d98f13167e17dd53"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const",
"Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
"Severity": "LOW",
"CweIDs": [
"CWE-674"
],
"VendorSeverity": {
"amazon": 1,
"debian": 1,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-27943",
"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79",
"https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead",
"https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-27943",
"https://sourceware.org/bugzilla/show_bug.cgi?id=28995",
"https://www.cve.org/CVERecord?id=CVE-2022-27943"
],
"PublishedDate": "2022-03-26T13:15:07.9Z",
"LastModifiedDate": "2024-11-21T06:56:31.04Z"
},
{
"VulnerabilityID": "CVE-2023-4039",
"PkgID": "libstdc++6@12.2.0-14",
"PkgName": "libstdc++6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14?arch=amd64\u0026distro=debian-12.10",
"UID": "d98f13167e17dd53"
},
"InstalledVersion": "12.2.0-14",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4039",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "gcc: -fstack-protector fails to guard dynamic stack allocations on ARM64",
"Description": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
"Severity": "LOW",
"CweIDs": [
"CWE-693"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"oracle-oval": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-4039",
"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64",
"https://gcc.gnu.org/git/?p=gcc.git;a=blob_plain;f=SECURITY.txt",
"https://gcc.gnu.org/pipermail/gcc-patches/2023-October/634066.html",
"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf",
"https://inbox.sourceware.org/gcc-patches/46cfa37b-56eb-344d-0745-e0d35393392d@gotplt.org",
"https://linux.oracle.com/cve/CVE-2023-4039.html",
"https://linux.oracle.com/errata/ELSA-2023-28766.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4039",
"https://rtx.meta.security/mitigation/2023/09/12/CVE-2023-4039.html",
"https://www.cve.org/CVERecord?id=CVE-2023-4039"
],
"PublishedDate": "2023-09-13T09:15:15.69Z",
"LastModifiedDate": "2025-02-13T17:17:14.717Z"
},
{
"VulnerabilityID": "CVE-2013-4392",
"PkgID": "libsystemd0@252.36-1~deb12u1",
"PkgName": "libsystemd0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libsystemd0@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "9dd113709a07c85c"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts",
"Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
"Severity": "LOW",
"CweIDs": [
"CWE-59"
],
"VendorSeverity": {
"debian": 1,
"nvd": 1,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"V2Score": 3.3
},
"redhat": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"V2Score": 3.3
}
},
"References": [
"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357",
"http://www.openwall.com/lists/oss-security/2013/10/01/9",
"https://access.redhat.com/security/cve/CVE-2013-4392",
"https://bugzilla.redhat.com/show_bug.cgi?id=859060",
"https://nvd.nist.gov/vuln/detail/CVE-2013-4392",
"https://www.cve.org/CVERecord?id=CVE-2013-4392"
],
"PublishedDate": "2013-10-28T22:55:03.773Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2023-31437",
"PkgID": "libsystemd0@252.36-1~deb12u1",
"PkgName": "libsystemd0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libsystemd0@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "9dd113709a07c85c"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...",
"Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.657Z",
"LastModifiedDate": "2025-01-03T20:15:26.457Z"
},
{
"VulnerabilityID": "CVE-2023-31438",
"PkgID": "libsystemd0@252.36-1~deb12u1",
"PkgName": "libsystemd0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libsystemd0@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "9dd113709a07c85c"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...",
"Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/pull/28886",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.707Z",
"LastModifiedDate": "2024-11-21T08:01:51.953Z"
},
{
"VulnerabilityID": "CVE-2023-31439",
"PkgID": "libsystemd0@252.36-1~deb12u1",
"PkgName": "libsystemd0",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libsystemd0@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "9dd113709a07c85c"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can modify the con ...",
"Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"amazon": 1,
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/pull/28885",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.753Z",
"LastModifiedDate": "2024-11-21T08:01:52.097Z"
},
{
"VulnerabilityID": "CVE-2023-52355",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52355",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM",
"Description": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.",
"Severity": "HIGH",
"CweIDs": [
"CWE-787"
],
"VendorSeverity": {
"nvd": 3,
"photon": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-52355",
"https://bugzilla.redhat.com/show_bug.cgi?id=2251326",
"https://gitlab.com/libtiff/libtiff/-/issues/621",
"https://nvd.nist.gov/vuln/detail/CVE-2023-52355",
"https://www.cve.org/CVERecord?id=CVE-2023-52355"
],
"PublishedDate": "2024-01-25T20:15:38.353Z",
"LastModifiedDate": "2024-11-21T08:39:38.02Z"
},
{
"VulnerabilityID": "CVE-2023-6277",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6277",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: Out-of-memory in TIFFOpen via a craft file",
"Description": "An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-400"
],
"VendorSeverity": {
"amazon": 3,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"photon": 3,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"http://seclists.org/fulldisclosure/2024/Jul/16",
"http://seclists.org/fulldisclosure/2024/Jul/17",
"http://seclists.org/fulldisclosure/2024/Jul/18",
"http://seclists.org/fulldisclosure/2024/Jul/19",
"http://seclists.org/fulldisclosure/2024/Jul/20",
"http://seclists.org/fulldisclosure/2024/Jul/21",
"http://seclists.org/fulldisclosure/2024/Jul/22",
"http://seclists.org/fulldisclosure/2024/Jul/23",
"https://access.redhat.com/security/cve/CVE-2023-6277",
"https://bugzilla.redhat.com/show_bug.cgi?id=2251311",
"https://gitlab.com/libtiff/libtiff/-/issues/614",
"https://gitlab.com/libtiff/libtiff/-/merge_requests/545",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJIN6DTSL3VODZUGWEUXLEL5DR53EZMV/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y7ZGN2MZXJ6E57W3L4YBM3ZPAU3T7T5C/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-6277",
"https://security.netapp.com/advisory/ntap-20240119-0002/",
"https://support.apple.com/kb/HT214116",
"https://support.apple.com/kb/HT214117",
"https://support.apple.com/kb/HT214118",
"https://support.apple.com/kb/HT214119",
"https://support.apple.com/kb/HT214120",
"https://support.apple.com/kb/HT214122",
"https://support.apple.com/kb/HT214123",
"https://support.apple.com/kb/HT214124",
"https://ubuntu.com/security/notices/USN-6644-1",
"https://ubuntu.com/security/notices/USN-6644-2",
"https://www.cve.org/CVERecord?id=CVE-2023-6277"
],
"PublishedDate": "2023-11-24T19:15:07.643Z",
"LastModifiedDate": "2024-11-21T08:43:31.253Z"
},
{
"VulnerabilityID": "CVE-2017-16232",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-16232",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: Memory leaks in tif_open.c, tif_lzw.c, and tif_aux.c",
"Description": "LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue",
"Severity": "LOW",
"CweIDs": [
"CWE-772"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 3.3
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html",
"http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html",
"http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html",
"http://seclists.org/fulldisclosure/2018/Dec/32",
"http://seclists.org/fulldisclosure/2018/Dec/47",
"http://www.openwall.com/lists/oss-security/2017/11/01/11",
"http://www.openwall.com/lists/oss-security/2017/11/01/3",
"http://www.openwall.com/lists/oss-security/2017/11/01/7",
"http://www.openwall.com/lists/oss-security/2017/11/01/8",
"http://www.securityfocus.com/bid/101696",
"https://access.redhat.com/security/cve/CVE-2017-16232",
"https://nvd.nist.gov/vuln/detail/CVE-2017-16232",
"https://www.cve.org/CVERecord?id=CVE-2017-16232"
],
"PublishedDate": "2019-03-21T15:59:56.53Z",
"LastModifiedDate": "2024-11-21T03:16:05.423Z"
},
{
"VulnerabilityID": "CVE-2017-17973",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-17973",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: heap-based use after free in tiff2pdf.c:t2p_writeproc",
"Description": "In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue",
"Severity": "LOW",
"CweIDs": [
"CWE-416"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"photon": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V2Score": 6.8,
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://bugzilla.maptools.org/show_bug.cgi?id=2769",
"http://www.securityfocus.com/bid/102331",
"https://access.redhat.com/security/cve/CVE-2017-17973",
"https://bugzilla.novell.com/show_bug.cgi?id=1074318",
"https://bugzilla.redhat.com/show_bug.cgi?id=1530912",
"https://nvd.nist.gov/vuln/detail/CVE-2017-17973",
"https://www.cve.org/CVERecord?id=CVE-2017-17973"
],
"PublishedDate": "2017-12-29T21:29:00.19Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2017-5563",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-5563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: Heap-buffer overflow in LZWEncode tif_lzw.c",
"Description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.",
"Severity": "LOW",
"CweIDs": [
"CWE-125"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V2Score": 6.8,
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"V3Score": 5.3
}
},
"References": [
"http://bugzilla.maptools.org/show_bug.cgi?id=2664",
"http://www.securityfocus.com/bid/95705",
"https://access.redhat.com/security/cve/CVE-2017-5563",
"https://nvd.nist.gov/vuln/detail/CVE-2017-5563",
"https://security.gentoo.org/glsa/201709-27",
"https://ubuntu.com/security/notices/USN-3606-1",
"https://usn.ubuntu.com/3606-1/",
"https://www.cve.org/CVERecord?id=CVE-2017-5563"
],
"PublishedDate": "2017-01-23T07:59:00.69Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2017-9117",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-9117",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: Heap-based buffer over-read in bmp2tiff",
"Description": "In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).",
"Severity": "LOW",
"CweIDs": [
"CWE-125"
],
"VendorSeverity": {
"debian": 1,
"nvd": 4,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V2Score": 7.5,
"V3Score": 9.8
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 3.3
}
},
"References": [
"http://bugzilla.maptools.org/show_bug.cgi?id=2690",
"http://www.securityfocus.com/bid/98581",
"https://access.redhat.com/security/cve/CVE-2017-9117",
"https://gitlab.com/libtiff/libtiff/-/issues/89",
"https://nvd.nist.gov/vuln/detail/CVE-2017-9117",
"https://ubuntu.com/security/notices/USN-3606-1",
"https://usn.ubuntu.com/3606-1/",
"https://www.cve.org/CVERecord?id=CVE-2017-9117"
],
"PublishedDate": "2017-05-21T19:29:00.187Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2018-10126",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-10126",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c",
"Description": "ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-476"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 3.3
}
},
"References": [
"http://bugzilla.maptools.org/show_bug.cgi?id=2786",
"https://access.redhat.com/security/cve/CVE-2018-10126",
"https://gitlab.com/libtiff/libtiff/-/issues/128",
"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2018-10126",
"https://www.cve.org/CVERecord?id=CVE-2018-10126"
],
"PublishedDate": "2018-04-21T21:29:00.29Z",
"LastModifiedDate": "2024-11-21T03:40:53.537Z"
},
{
"VulnerabilityID": "CVE-2022-1210",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-1210",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "tiff: Malicious file leads to a denial of service in TIFF File Handler",
"Description": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.",
"Severity": "LOW",
"CweIDs": [
"CWE-400",
"CWE-404"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 4.3
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-1210",
"https://gitlab.com/libtiff/libtiff/-/issues/402",
"https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1210",
"https://security.gentoo.org/glsa/202210-10",
"https://security.netapp.com/advisory/ntap-20220513-0005/",
"https://vuldb.com/?id.196363",
"https://www.cve.org/CVERecord?id=CVE-2022-1210"
],
"PublishedDate": "2022-04-03T09:15:09.033Z",
"LastModifiedDate": "2024-11-21T06:40:15.74Z"
},
{
"VulnerabilityID": "CVE-2023-1916",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-1916",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: out-of-bounds read in extractImageSection() in tools/tiffcrop.c",
"Description": "A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.",
"Severity": "LOW",
"CweIDs": [
"CWE-125"
],
"VendorSeverity": {
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"V3Score": 6.1
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"V3Score": 6.1
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-1916",
"https://gitlab.com/libtiff/libtiff/-/issues/536",
"https://gitlab.com/libtiff/libtiff/-/issues/536%2C",
"https://gitlab.com/libtiff/libtiff/-/issues/536,",
"https://gitlab.com/libtiff/libtiff/-/issues/537",
"https://nvd.nist.gov/vuln/detail/CVE-2023-1916",
"https://support.apple.com/kb/HT213844",
"https://ubuntu.com/security/notices/USN-6428-1",
"https://www.cve.org/CVERecord?id=CVE-2023-1916"
],
"PublishedDate": "2023-04-10T22:15:09.223Z",
"LastModifiedDate": "2024-11-21T07:40:08.09Z"
},
{
"VulnerabilityID": "CVE-2023-3164",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-3164",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: heap-buffer-overflow in extractImageSection()",
"Description": "A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.",
"Severity": "LOW",
"CweIDs": [
"CWE-120",
"CWE-787"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-3164",
"https://bugzilla.redhat.com/show_bug.cgi?id=2213531",
"https://gitlab.com/libtiff/libtiff/-/issues/542",
"https://gitlab.com/libtiff/libtiff/-/merge_requests/595",
"https://nvd.nist.gov/vuln/detail/CVE-2023-3164",
"https://ubuntu.com/security/notices/USN-6827-1",
"https://www.cve.org/CVERecord?id=CVE-2023-3164"
],
"PublishedDate": "2023-11-02T12:15:09.543Z",
"LastModifiedDate": "2024-11-21T08:16:36.097Z"
},
{
"VulnerabilityID": "CVE-2023-6228",
"PkgID": "libtiff6@4.5.0-6+deb12u2",
"PkgName": "libtiff6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "c97a98b3b324d944"
},
"InstalledVersion": "4.5.0-6+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6228",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c",
"Description": "An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.",
"Severity": "LOW",
"CweIDs": [
"CWE-787"
],
"VendorSeverity": {
"alma": 2,
"cbl-mariner": 1,
"debian": 1,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 1,
"rocky": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 3.3
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:2289",
"https://access.redhat.com/errata/RHSA-2024:5079",
"https://access.redhat.com/security/cve/CVE-2023-6228",
"https://bugzilla.redhat.com/2215865",
"https://bugzilla.redhat.com/2234970",
"https://bugzilla.redhat.com/2235264",
"https://bugzilla.redhat.com/2235265",
"https://bugzilla.redhat.com/2240995",
"https://bugzilla.redhat.com/show_bug.cgi?id=1614051",
"https://bugzilla.redhat.com/show_bug.cgi?id=2218744",
"https://bugzilla.redhat.com/show_bug.cgi?id=2240995",
"https://bugzilla.redhat.com/show_bug.cgi?id=2251344",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25433",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6228",
"https://errata.almalinux.org/9/ALSA-2024-2289.html",
"https://errata.rockylinux.org/RLSA-2024:5079",
"https://linux.oracle.com/cve/CVE-2023-6228.html",
"https://linux.oracle.com/errata/ELSA-2024-5079.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-6228",
"https://ubuntu.com/security/notices/USN-6644-1",
"https://ubuntu.com/security/notices/USN-6644-2",
"https://www.cve.org/CVERecord?id=CVE-2023-6228"
],
"PublishedDate": "2023-12-18T14:15:11.84Z",
"LastModifiedDate": "2024-11-21T08:43:24.483Z"
},
{
"VulnerabilityID": "CVE-2023-50495",
"PkgID": "libtinfo6@6.4-4",
"PkgName": "libtinfo6",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.10",
"UID": "c798ccd544602ef8"
},
"InstalledVersion": "6.4-4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "ncurses: segmentation fault via _nc_wrap_entry()",
"Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
"Severity": "MEDIUM",
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-50495",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-50495",
"https://security.netapp.com/advisory/ntap-20240119-0008/",
"https://ubuntu.com/security/notices/USN-6684-1",
"https://www.cve.org/CVERecord?id=CVE-2023-50495"
],
"PublishedDate": "2023-12-12T15:15:07.867Z",
"LastModifiedDate": "2024-11-21T08:37:04.243Z"
},
{
"VulnerabilityID": "CVE-2013-4392",
"PkgID": "libudev1@252.36-1~deb12u1",
"PkgName": "libudev1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libudev1@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "73f955f96c796a94"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts",
"Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
"Severity": "LOW",
"CweIDs": [
"CWE-59"
],
"VendorSeverity": {
"debian": 1,
"nvd": 1,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"V2Score": 3.3
},
"redhat": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"V2Score": 3.3
}
},
"References": [
"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357",
"http://www.openwall.com/lists/oss-security/2013/10/01/9",
"https://access.redhat.com/security/cve/CVE-2013-4392",
"https://bugzilla.redhat.com/show_bug.cgi?id=859060",
"https://nvd.nist.gov/vuln/detail/CVE-2013-4392",
"https://www.cve.org/CVERecord?id=CVE-2013-4392"
],
"PublishedDate": "2013-10-28T22:55:03.773Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2023-31437",
"PkgID": "libudev1@252.36-1~deb12u1",
"PkgName": "libudev1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libudev1@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "73f955f96c796a94"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...",
"Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.657Z",
"LastModifiedDate": "2025-01-03T20:15:26.457Z"
},
{
"VulnerabilityID": "CVE-2023-31438",
"PkgID": "libudev1@252.36-1~deb12u1",
"PkgName": "libudev1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libudev1@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "73f955f96c796a94"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...",
"Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/pull/28886",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.707Z",
"LastModifiedDate": "2024-11-21T08:01:51.953Z"
},
{
"VulnerabilityID": "CVE-2023-31439",
"PkgID": "libudev1@252.36-1~deb12u1",
"PkgName": "libudev1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libudev1@252.36-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "73f955f96c796a94"
},
"InstalledVersion": "252.36-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "An issue was discovered in systemd 253. An attacker can modify the con ...",
"Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"",
"Severity": "LOW",
"CweIDs": [
"CWE-354"
],
"VendorSeverity": {
"amazon": 1,
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 5.3
}
},
"References": [
"https://github.com/kastel-security/Journald",
"https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf",
"https://github.com/systemd/systemd/pull/28885",
"https://github.com/systemd/systemd/releases"
],
"PublishedDate": "2023-06-13T17:15:14.753Z",
"LastModifiedDate": "2024-11-21T08:01:52.097Z"
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "libuuid1@2.38.1-5+deb12u3",
"PkgName": "libuuid1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "9ad01d49bd044281"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2024-25062",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-25062",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: use-after-free in XMLReader",
"Description": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.",
"Severity": "HIGH",
"CweIDs": [
"CWE-416"
],
"VendorSeverity": {
"alma": 2,
"azure": 3,
"cbl-mariner": 3,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2024:2679",
"https://access.redhat.com/security/cve/CVE-2024-25062",
"https://bugzilla.redhat.com/2262726",
"https://bugzilla.redhat.com/show_bug.cgi?id=2262726",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062",
"https://errata.almalinux.org/9/ALSA-2024-2679.html",
"https://errata.rockylinux.org/RLSA-2024:2679",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/604",
"https://gitlab.gnome.org/GNOME/libxml2/-/tags",
"https://linux.oracle.com/cve/CVE-2024-25062.html",
"https://linux.oracle.com/errata/ELSA-2024-3626.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-25062",
"https://ubuntu.com/security/notices/USN-6658-1",
"https://ubuntu.com/security/notices/USN-6658-2",
"https://www.cve.org/CVERecord?id=CVE-2024-25062"
],
"PublishedDate": "2024-02-04T16:15:45.12Z",
"LastModifiedDate": "2024-11-21T09:00:10.427Z"
},
{
"VulnerabilityID": "CVE-2024-56171",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56171",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: Use-After-Free in libxml2",
"Description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
"Severity": "HIGH",
"CweIDs": [
"CWE-416"
],
"VendorSeverity": {
"alma": 3,
"amazon": 3,
"azure": 3,
"cbl-mariner": 3,
"oracle-oval": 3,
"photon": 3,
"redhat": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"V3Score": 8.1
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2679",
"https://access.redhat.com/security/cve/CVE-2024-56171",
"https://bugzilla.redhat.com/2346416",
"https://bugzilla.redhat.com/2346421",
"https://errata.almalinux.org/9/ALSA-2025-2679.html",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/828",
"https://linux.oracle.com/cve/CVE-2024-56171.html",
"https://linux.oracle.com/errata/ELSA-2025-2686.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-56171",
"https://security.netapp.com/advisory/ntap-20250328-0010/",
"https://ubuntu.com/security/notices/USN-7302-1",
"https://www.cve.org/CVERecord?id=CVE-2024-56171",
"https://www.openwall.com/lists/oss-security/2025/02/18/2"
],
"PublishedDate": "2025-02-18T22:15:12.797Z",
"LastModifiedDate": "2025-03-28T15:15:46.003Z"
},
{
"VulnerabilityID": "CVE-2025-24928",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-24928",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2",
"Description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.",
"Severity": "HIGH",
"CweIDs": [
"CWE-121"
],
"VendorSeverity": {
"alma": 3,
"amazon": 3,
"azure": 3,
"cbl-mariner": 3,
"oracle-oval": 3,
"photon": 3,
"redhat": 3,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"V3Score": 7.8
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:2679",
"https://access.redhat.com/security/cve/CVE-2025-24928",
"https://bugzilla.redhat.com/2346416",
"https://bugzilla.redhat.com/2346421",
"https://errata.almalinux.org/9/ALSA-2025-2679.html",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/847",
"https://issues.oss-fuzz.com/issues/392687022",
"https://linux.oracle.com/cve/CVE-2025-24928.html",
"https://linux.oracle.com/errata/ELSA-2025-2686.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-24928",
"https://security.netapp.com/advisory/ntap-20250321-0006/",
"https://ubuntu.com/security/notices/USN-7302-1",
"https://www.cve.org/CVERecord?id=CVE-2025-24928",
"https://www.openwall.com/lists/oss-security/2025/02/18/2"
],
"PublishedDate": "2025-02-18T23:15:10.25Z",
"LastModifiedDate": "2025-03-21T18:15:34.86Z"
},
{
"VulnerabilityID": "CVE-2025-27113",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-27113",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: NULL Pointer Dereference in libxml2 xmlPatMatch",
"Description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.",
"Severity": "HIGH",
"CweIDs": [
"CWE-476"
],
"VendorSeverity": {
"amazon": 3,
"azure": 1,
"cbl-mariner": 1,
"nvd": 3,
"photon": 3,
"redhat": 1,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"V3Score": 3.1
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-27113",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/861",
"https://nvd.nist.gov/vuln/detail/CVE-2025-27113",
"https://security.netapp.com/advisory/ntap-20250306-0004/",
"https://ubuntu.com/security/notices/USN-7302-1",
"https://www.cve.org/CVERecord?id=CVE-2025-27113",
"https://www.openwall.com/lists/oss-security/2025/02/18/2"
],
"PublishedDate": "2025-02-18T23:15:10.96Z",
"LastModifiedDate": "2025-03-07T01:15:12.823Z"
},
{
"VulnerabilityID": "CVE-2025-32414",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-32414",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: Out-of-Bounds Read in libxml2",
"Description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
"Severity": "HIGH",
"CweIDs": [
"CWE-393",
"CWE-252"
],
"VendorSeverity": {
"nvd": 3,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"V3Score": 5.6
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-32414",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889",
"https://nvd.nist.gov/vuln/detail/CVE-2025-32414",
"https://ubuntu.com/security/notices/USN-7467-1",
"https://ubuntu.com/security/notices/USN-7467-2",
"https://www.cve.org/CVERecord?id=CVE-2025-32414"
],
"PublishedDate": "2025-04-08T03:15:15.94Z",
"LastModifiedDate": "2025-04-23T19:09:35.517Z"
},
{
"VulnerabilityID": "CVE-2025-32415",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-32415",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables",
"Description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
"Severity": "HIGH",
"CweIDs": [
"CWE-1284",
"CWE-125"
],
"VendorSeverity": {
"nvd": 3,
"photon": 1,
"redhat": 1,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 2.9
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2025-32415",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890",
"https://nvd.nist.gov/vuln/detail/CVE-2025-32415",
"https://ubuntu.com/security/notices/USN-7467-1",
"https://ubuntu.com/security/notices/USN-7467-2",
"https://www.cve.org/CVERecord?id=CVE-2025-32415"
],
"PublishedDate": "2025-04-17T17:15:33.733Z",
"LastModifiedDate": "2025-04-23T18:17:52.053Z"
},
{
"VulnerabilityID": "CVE-2022-49043",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-49043",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml: use-after-free in xmlXIncludeAddNode",
"Description": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-416"
],
"VendorSeverity": {
"alma": 3,
"amazon": 3,
"cbl-mariner": 4,
"oracle-oval": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:1350",
"https://access.redhat.com/security/cve/CVE-2022-49043",
"https://bugzilla.redhat.com/2342118",
"https://bugzilla.redhat.com/show_bug.cgi?id=2342118",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49043",
"https://errata.almalinux.org/9/ALSA-2025-1350.html",
"https://errata.rockylinux.org/RLSA-2025:1517",
"https://github.com/php/php-src/issues/17467",
"https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b",
"https://linux.oracle.com/cve/CVE-2022-49043.html",
"https://linux.oracle.com/errata/ELSA-2025-1517.html",
"https://nvd.nist.gov/vuln/detail/CVE-2022-49043",
"https://ubuntu.com/security/notices/USN-7240-1",
"https://ubuntu.com/security/notices/USN-7302-1",
"https://www.cve.org/CVERecord?id=CVE-2022-49043"
],
"PublishedDate": "2025-01-26T06:15:21Z",
"LastModifiedDate": "2025-01-26T06:15:21Z"
},
{
"VulnerabilityID": "CVE-2023-39615",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39615",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: crafted xml can cause global buffer overflow",
"Description": "Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-119"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2023:7747",
"https://access.redhat.com/security/cve/CVE-2023-39615",
"https://bugzilla.redhat.com/2235864",
"https://errata.almalinux.org/9/ALSA-2023-7747.html",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/535",
"https://linux.oracle.com/cve/CVE-2023-39615.html",
"https://linux.oracle.com/errata/ELSA-2024-0119.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-39615",
"https://www.cve.org/CVERecord?id=CVE-2023-39615"
],
"PublishedDate": "2023-08-29T17:15:12.527Z",
"LastModifiedDate": "2024-11-21T08:15:42.583Z"
},
{
"VulnerabilityID": "CVE-2023-45322",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45322",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: use-after-free in xmlUnlinkNode() in tree.c",
"Description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-416"
],
"VendorSeverity": {
"amazon": 3,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"photon": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2023/10/06/5",
"https://access.redhat.com/security/cve/CVE-2023-45322",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/344",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/583",
"https://nvd.nist.gov/vuln/detail/CVE-2023-45322",
"https://www.cve.org/CVERecord?id=CVE-2023-45322"
],
"PublishedDate": "2023-10-06T22:15:11.66Z",
"LastModifiedDate": "2024-11-21T08:26:44.78Z"
},
{
"VulnerabilityID": "CVE-2024-34459",
"PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u1",
"PkgName": "libxml2",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "1011f6e78c566886"
},
"InstalledVersion": "2.9.14+dfsg-1.3~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-34459",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c",
"Description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.",
"Severity": "LOW",
"CweIDs": [
"CWE-122"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 3,
"debian": 1,
"photon": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2024-34459",
"https://gitlab.gnome.org/GNOME/libxml2/-/issues/720",
"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8",
"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/",
"https://nvd.nist.gov/vuln/detail/CVE-2024-34459",
"https://ubuntu.com/security/notices/USN-7240-1",
"https://ubuntu.com/security/notices/USN-7302-1",
"https://www.cve.org/CVERecord?id=CVE-2024-34459"
],
"PublishedDate": "2024-05-14T15:39:11.917Z",
"LastModifiedDate": "2024-11-21T09:18:43.59Z"
},
{
"VulnerabilityID": "CVE-2015-9019",
"PkgID": "libxslt1.1@1.1.35-1+deb12u1",
"PkgName": "libxslt1.1",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/libxslt1.1@1.1.35-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "4f2e71f8a62b1771"
},
"InstalledVersion": "1.1.35-1+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-9019",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "libxslt: math.random() in xslt uses unseeded randomness",
"Description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.",
"Severity": "LOW",
"CweIDs": [
"CWE-330"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2015-9019",
"https://bugzilla.gnome.org/show_bug.cgi?id=758400",
"https://bugzilla.suse.com/show_bug.cgi?id=934119",
"https://nvd.nist.gov/vuln/detail/CVE-2015-9019",
"https://www.cve.org/CVERecord?id=CVE-2015-9019"
],
"PublishedDate": "2017-04-05T21:59:00.147Z",
"LastModifiedDate": "2025-04-20T01:37:25.86Z"
},
{
"VulnerabilityID": "CVE-2023-4641",
"PkgID": "login@1:4.13+dfsg1-1+b1",
"PkgName": "login",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "9c383ff5c6ed1c81"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4641",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow-utils: possible password leak during passwd(1) change",
"Description": "A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-303",
"CWE-287"
],
"VendorSeverity": {
"alma": 1,
"amazon": 1,
"nvd": 2,
"oracle-oval": 1,
"photon": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2023:6632",
"https://access.redhat.com/errata/RHSA-2023:7112",
"https://access.redhat.com/errata/RHSA-2024:0417",
"https://access.redhat.com/errata/RHSA-2024:2577",
"https://access.redhat.com/security/cve/CVE-2023-4641",
"https://bugzilla.redhat.com/2215945",
"https://bugzilla.redhat.com/show_bug.cgi?id=2215945",
"https://errata.almalinux.org/9/ALSA-2023-6632.html",
"https://linux.oracle.com/cve/CVE-2023-4641.html",
"https://linux.oracle.com/errata/ELSA-2023-7112.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4641",
"https://ubuntu.com/security/notices/USN-6640-1",
"https://www.cve.org/CVERecord?id=CVE-2023-4641"
],
"PublishedDate": "2023-12-27T16:15:13.363Z",
"LastModifiedDate": "2024-11-21T08:35:35.837Z"
},
{
"VulnerabilityID": "CVE-2007-5686",
"PkgID": "login@1:4.13+dfsg1-1+b1",
"PkgName": "login",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "9c383ff5c6ed1c81"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...",
"Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.",
"Severity": "LOW",
"CweIDs": [
"CWE-264"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"V2Score": 4.9
}
},
"References": [
"http://secunia.com/advisories/27215",
"http://www.securityfocus.com/archive/1/482129/100/100/threaded",
"http://www.securityfocus.com/archive/1/482857/100/0/threaded",
"http://www.securityfocus.com/bid/26048",
"http://www.vupen.com/english/advisories/2007/3474",
"https://issues.rpath.com/browse/RPL-1825"
],
"PublishedDate": "2007-10-28T17:08:00Z",
"LastModifiedDate": "2024-11-21T00:38:27.587Z"
},
{
"VulnerabilityID": "CVE-2023-29383",
"PkgID": "login@1:4.13+dfsg1-1+b1",
"PkgName": "login",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "9c383ff5c6ed1c81"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29383",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow: Improper input validation in shadow-utils package utility chfn",
"Description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.",
"Severity": "LOW",
"CweIDs": [
"CWE-74",
"CWE-125"
],
"VendorSeverity": {
"cbl-mariner": 1,
"nvd": 1,
"photon": 1,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 3.3
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-29383",
"https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d",
"https://github.com/shadow-maint/shadow/pull/687",
"https://nvd.nist.gov/vuln/detail/CVE-2023-29383",
"https://www.cve.org/CVERecord?id=CVE-2023-29383",
"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/",
"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797"
],
"PublishedDate": "2023-04-14T22:15:07.68Z",
"LastModifiedDate": "2025-02-06T22:15:35.057Z"
},
{
"VulnerabilityID": "CVE-2024-56433",
"PkgID": "login@1:4.13+dfsg1-1+b1",
"PkgName": "login",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "9c383ff5c6ed1c81"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise",
"Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.",
"Severity": "LOW",
"CweIDs": [
"CWE-1188"
],
"VendorSeverity": {
"azure": 1,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 3.6
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2024-56433",
"https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241",
"https://github.com/shadow-maint/shadow/issues/1157",
"https://github.com/shadow-maint/shadow/releases/tag/4.4",
"https://nvd.nist.gov/vuln/detail/CVE-2024-56433",
"https://www.cve.org/CVERecord?id=CVE-2024-56433"
],
"PublishedDate": "2024-12-26T09:15:07.267Z",
"LastModifiedDate": "2024-12-26T09:15:07.267Z"
},
{
"VulnerabilityID": "TEMP-0628843-DBAD28",
"PkgID": "login@1:4.13+dfsg1-1+b1",
"PkgName": "login",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "9c383ff5c6ed1c81"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "[more related to CVE-2005-4890]",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1
}
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "mount@2.38.1-5+deb12u3",
"PkgName": "mount",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "63b0977e705f5d35"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2023-50495",
"PkgID": "ncurses-base@6.4-4",
"PkgName": "ncurses-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.10",
"UID": "9836f95b93f3d6b3"
},
"InstalledVersion": "6.4-4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "ncurses: segmentation fault via _nc_wrap_entry()",
"Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
"Severity": "MEDIUM",
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-50495",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-50495",
"https://security.netapp.com/advisory/ntap-20240119-0008/",
"https://ubuntu.com/security/notices/USN-6684-1",
"https://www.cve.org/CVERecord?id=CVE-2023-50495"
],
"PublishedDate": "2023-12-12T15:15:07.867Z",
"LastModifiedDate": "2024-11-21T08:37:04.243Z"
},
{
"VulnerabilityID": "CVE-2023-50495",
"PkgID": "ncurses-bin@6.4-4",
"PkgName": "ncurses-bin",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.10",
"UID": "d53f35453c9fec6d"
},
"InstalledVersion": "6.4-4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "ncurses: segmentation fault via _nc_wrap_entry()",
"Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
"Severity": "MEDIUM",
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"nvd": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 6.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-50495",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html",
"https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-50495",
"https://security.netapp.com/advisory/ntap-20240119-0008/",
"https://ubuntu.com/security/notices/USN-6684-1",
"https://www.cve.org/CVERecord?id=CVE-2023-50495"
],
"PublishedDate": "2023-12-12T15:15:07.867Z",
"LastModifiedDate": "2024-11-21T08:37:04.243Z"
},
{
"VulnerabilityID": "CVE-2024-7347",
"PkgID": "nginx@1.27.5-1~bookworm",
"PkgName": "nginx",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/nginx@1.27.5-1~bookworm?arch=amd64\u0026distro=debian-12.10",
"UID": "cc598444ac4c52a1"
},
"InstalledVersion": "1.27.5-1~bookworm",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-7347",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "nginx: specially crafted MP4 file may cause denial of service",
"Description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-126",
"CWE-125"
],
"VendorSeverity": {
"alma": 2,
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"nvd": 2,
"oracle-oval": 2,
"photon": 2,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 4.7
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 4.7
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2024/08/14/4",
"https://access.redhat.com/errata/RHSA-2025:3261",
"https://access.redhat.com/security/cve/CVE-2024-7347",
"https://errata.almalinux.org/9/ALSA-2025-3261.html",
"https://forum.nginx.org/read.php?27,300027",
"https://linux.oracle.com/cve/CVE-2024-7347.html",
"https://linux.oracle.com/errata/ELSA-2025-3262.html",
"https://my.f5.com/manage/s/article/K000140529",
"https://nvd.nist.gov/vuln/detail/CVE-2024-7347",
"https://ubuntu.com/security/notices/USN-7014-1",
"https://ubuntu.com/security/notices/USN-7014-2",
"https://ubuntu.com/security/notices/USN-7014-3",
"https://www.cve.org/CVERecord?id=CVE-2024-7347"
],
"PublishedDate": "2024-08-14T15:15:31.87Z",
"LastModifiedDate": "2025-01-22T16:10:28.49Z"
},
{
"VulnerabilityID": "CVE-2009-4487",
"PkgID": "nginx@1.27.5-1~bookworm",
"PkgName": "nginx",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/nginx@1.27.5-1~bookworm?arch=amd64\u0026distro=debian-12.10",
"UID": "cc598444ac4c52a1"
},
"InstalledVersion": "1.27.5-1~bookworm",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2009-4487",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "nginx: Absent sanitation of escape sequences in web server log",
"Description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.",
"Severity": "LOW",
"VendorSeverity": {
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"V2Score": 6.8
},
"redhat": {
"V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"V2Score": 2.6
}
},
"References": [
"http://www.securityfocus.com/archive/1/508830/100/0/threaded",
"http://www.securityfocus.com/bid/37711",
"http://www.ush.it/team/ush/hack_httpd_escape/adv.txt",
"https://access.redhat.com/security/cve/CVE-2009-4487",
"https://nvd.nist.gov/vuln/detail/CVE-2009-4487",
"https://www.cve.org/CVERecord?id=CVE-2009-4487"
],
"PublishedDate": "2010-01-13T20:30:00.357Z",
"LastModifiedDate": "2024-11-21T01:09:45.65Z"
},
{
"VulnerabilityID": "CVE-2013-0337",
"PkgID": "nginx@1.27.5-1~bookworm",
"PkgName": "nginx",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/nginx@1.27.5-1~bookworm?arch=amd64\u0026distro=debian-12.10",
"UID": "cc598444ac4c52a1"
},
"InstalledVersion": "1.27.5-1~bookworm",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-0337",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "The default configuration of nginx, possibly 1.3.13 and earlier, uses ...",
"Description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.",
"Severity": "LOW",
"CweIDs": [
"CWE-264"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"V2Score": 7.5
}
},
"References": [
"http://secunia.com/advisories/55181",
"http://security.gentoo.org/glsa/glsa-201310-04.xml",
"http://www.openwall.com/lists/oss-security/2013/02/21/15",
"http://www.openwall.com/lists/oss-security/2013/02/22/1",
"http://www.openwall.com/lists/oss-security/2013/02/24/1"
],
"PublishedDate": "2013-10-27T00:55:03.713Z",
"LastModifiedDate": "2025-04-11T00:51:21.963Z"
},
{
"VulnerabilityID": "CVE-2023-44487",
"PkgID": "nginx@1.27.5-1~bookworm",
"PkgName": "nginx",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/nginx@1.27.5-1~bookworm?arch=amd64\u0026distro=debian-12.10",
"UID": "cc598444ac4c52a1"
},
"InstalledVersion": "1.27.5-1~bookworm",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-44487",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)",
"Description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
"Severity": "LOW",
"CweIDs": [
"CWE-400"
],
"VendorSeverity": {
"alma": 3,
"amazon": 3,
"azure": 3,
"bitnami": 3,
"cbl-mariner": 3,
"debian": 1,
"ghsa": 2,
"nvd": 3,
"oracle-oval": 3,
"photon": 3,
"redhat": 3,
"rocky": 3,
"ubuntu": 3
},
"CVSS": {
"bitnami": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"V3Score": 5.3
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2023/10/10/6",
"http://www.openwall.com/lists/oss-security/2023/10/10/7",
"http://www.openwall.com/lists/oss-security/2023/10/13/4",
"http://www.openwall.com/lists/oss-security/2023/10/13/9",
"http://www.openwall.com/lists/oss-security/2023/10/18/4",
"http://www.openwall.com/lists/oss-security/2023/10/18/8",
"http://www.openwall.com/lists/oss-security/2023/10/19/6",
"http://www.openwall.com/lists/oss-security/2023/10/20/8",
"https://access.redhat.com/errata/RHSA-2023:6746",
"https://access.redhat.com/security/cve/CVE-2023-44487",
"https://access.redhat.com/security/cve/cve-2023-44487",
"https://akka.io/security/akka-http-cve-2023-44487.html",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size",
"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011",
"https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack",
"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack",
"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty",
"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"https://blog.vespa.ai/cve-2023-44487",
"https://blog.vespa.ai/cve-2023-44487/",
"https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"https://bugzilla.redhat.com/2242803",
"https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"https://chaos.social/@icing/111210915918780532",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps",
"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487",
"https://devblogs.microsoft.com/dotnet/october-2023-updates/",
"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"https://errata.almalinux.org/9/ALSA-2023-6746.html",
"https://errata.rockylinux.org/RLSA-2023:5838",
"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"https://github.com/Azure/AKS/issues/3947",
"https://github.com/Kong/kong/discussions/11741",
"https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/advisories/GHSA-vx74-f528-fxqg",
"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"https://github.com/akka/akka-http/issues/4323",
"https://github.com/akka/akka-http/pull/4324",
"https://github.com/akka/akka-http/pull/4325",
"https://github.com/alibaba/tengine/issues/1872",
"https://github.com/apache/apisix/issues/10320",
"https://github.com/apache/httpd-site/pull/10",
"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
"https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628",
"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"https://github.com/apache/trafficserver/pull/10564",
"https://github.com/apple/swift-nio-http2",
"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3",
"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"https://github.com/bcdannyboy/CVE-2023-44487",
"https://github.com/caddyserver/caddy/issues/5877",
"https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"https://github.com/dotnet/announcements/issues/277",
"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
"https://github.com/eclipse/jetty.project/issues/10679",
"https://github.com/envoyproxy/envoy/pull/30055",
"https://github.com/etcd-io/etcd/issues/16740",
"https://github.com/facebook/proxygen/pull/466",
"https://github.com/golang/go/issues/63417",
"https://github.com/grpc/grpc-go/pull/6703",
"https://github.com/grpc/grpc-go/releases",
"https://github.com/grpc/grpc/releases/tag/v1.59.2",
"https://github.com/h2o/h2o/pull/3291",
"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"https://github.com/haproxy/haproxy/issues/2312",
"https://github.com/hyperium/hyper/issues/3337",
"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
"https://github.com/junkurihara/rust-rpxy/issues/97",
"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"https://github.com/kazu-yamamoto/http2/issues/93",
"https://github.com/kubernetes/kubernetes/pull/121120",
"https://github.com/line/armeria/pull/5232",
"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"https://github.com/micrictor/http2-rst-stream",
"https://github.com/microsoft/CBL-Mariner/pull/6381",
"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"https://github.com/nghttp2/nghttp2/pull/1961",
"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"https://github.com/ninenines/cowboy/issues/1615",
"https://github.com/nodejs/node/pull/50121",
"https://github.com/openresty/openresty/issues/930",
"https://github.com/opensearch-project/data-prepper/issues/3474",
"https://github.com/oqtane/oqtane.framework/discussions/3367",
"https://github.com/projectcontour/contour/pull/5826",
"https://github.com/tempesta-tech/tempesta/issues/1986",
"https://github.com/varnishcache/varnish-cache/issues/3996",
"https://go.dev/cl/534215",
"https://go.dev/cl/534235",
"https://go.dev/issue/63417",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ",
"https://istio.io/latest/news/security/istio-security-2023-004",
"https://istio.io/latest/news/security/istio-security-2023-004/",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487",
"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
"https://linux.oracle.com/cve/CVE-2023-44487.html",
"https://linux.oracle.com/errata/ELSA-2024-1444.html",
"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2",
"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"https://my.f5.com/manage/s/article/K000137106",
"https://netty.io/news/2023/10/10/4-1-100-Final.html",
"https://news.ycombinator.com/item?id=37830987",
"https://news.ycombinator.com/item?id=37830998",
"https://news.ycombinator.com/item?id=37831062",
"https://news.ycombinator.com/item?id=37837043",
"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases",
"https://nvd.nist.gov/vuln/detail/CVE-2023-44487",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response",
"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"https://pkg.go.dev/vuln/GO-2023-2102",
"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"https://security.gentoo.org/glsa/202311-09",
"https://security.netapp.com/advisory/ntap-20231016-0001",
"https://security.netapp.com/advisory/ntap-20231016-0001/",
"https://security.netapp.com/advisory/ntap-20240426-0007",
"https://security.netapp.com/advisory/ntap-20240426-0007/",
"https://security.netapp.com/advisory/ntap-20240621-0006",
"https://security.netapp.com/advisory/ntap-20240621-0006/",
"https://security.netapp.com/advisory/ntap-20240621-0007",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://security.paloaltonetworks.com/CVE-2023-44487",
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12",
"https://tomcat.apache.org/security-8.html",
"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94",
"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81",
"https://ubuntu.com/security/CVE-2023-44487",
"https://ubuntu.com/security/notices/USN-6427-1",
"https://ubuntu.com/security/notices/USN-6427-2",
"https://ubuntu.com/security/notices/USN-6438-1",
"https://ubuntu.com/security/notices/USN-6505-1",
"https://ubuntu.com/security/notices/USN-6574-1",
"https://ubuntu.com/security/notices/USN-6754-1",
"https://ubuntu.com/security/notices/USN-6994-1",
"https://ubuntu.com/security/notices/USN-7067-1",
"https://ubuntu.com/security/notices/USN-7410-1",
"https://ubuntu.com/security/notices/USN-7469-1",
"https://ubuntu.com/security/notices/USN-7469-2",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records",
"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"https://www.cve.org/CVERecord?id=CVE-2023-44487",
"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522",
"https://www.debian.org/security/2023/dsa-5540",
"https://www.debian.org/security/2023/dsa-5549",
"https://www.debian.org/security/2023/dsa-5558",
"https://www.debian.org/security/2023/dsa-5570",
"https://www.eclipse.org/lists/jetty-announce/msg00181.html",
"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"https://www.mail-archive.com/haproxy@formilux.org/msg44134.html",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487",
"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products",
"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"https://www.openwall.com/lists/oss-security/2023/10/10/6",
"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday",
"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
],
"PublishedDate": "2023-10-10T14:15:10.883Z",
"LastModifiedDate": "2025-04-12T01:00:01.957Z"
},
{
"VulnerabilityID": "CVE-2024-13176",
"PkgID": "openssl@3.0.15-1~deb12u1",
"PkgName": "openssl",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/openssl@3.0.15-1~deb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "eaef4b3cbff90c54"
},
"InstalledVersion": "3.0.15-1~deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:91311529275035c77ef310fe38a81841c8f3e0a324cf6a68d86b36f48a145d0a",
"DiffID": "sha256:84accda66bf08ee5b495ac11c2c2d2b8fa0773bdd148b1976788ca4a64775d38"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-13176",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "openssl: Timing side-channel in ECDSA signature computation",
"Description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-385"
],
"VendorSeverity": {
"amazon": 2,
"azure": 2,
"cbl-mariner": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2025/01/20/2",
"https://access.redhat.com/security/cve/CVE-2024-13176",
"https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844",
"https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467",
"https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902",
"https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65",
"https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f",
"https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded",
"https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86",
"https://nvd.nist.gov/vuln/detail/CVE-2024-13176",
"https://openssl-library.org/news/secadv/20250120.txt",
"https://security.netapp.com/advisory/ntap-20250124-0005/",
"https://security.netapp.com/advisory/ntap-20250418-0010/",
"https://ubuntu.com/security/notices/USN-7264-1",
"https://ubuntu.com/security/notices/USN-7278-1",
"https://www.cve.org/CVERecord?id=CVE-2024-13176",
"https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL"
],
"PublishedDate": "2025-01-20T14:15:26.247Z",
"LastModifiedDate": "2025-04-19T01:15:43.007Z"
},
{
"VulnerabilityID": "CVE-2023-4641",
"PkgID": "passwd@1:4.13+dfsg1-1+b1",
"PkgName": "passwd",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "414b9b1c20179157"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4641",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow-utils: possible password leak during passwd(1) change",
"Description": "A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-303",
"CWE-287"
],
"VendorSeverity": {
"alma": 1,
"amazon": 1,
"nvd": 2,
"oracle-oval": 1,
"photon": 2,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 4.7
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2023:6632",
"https://access.redhat.com/errata/RHSA-2023:7112",
"https://access.redhat.com/errata/RHSA-2024:0417",
"https://access.redhat.com/errata/RHSA-2024:2577",
"https://access.redhat.com/security/cve/CVE-2023-4641",
"https://bugzilla.redhat.com/2215945",
"https://bugzilla.redhat.com/show_bug.cgi?id=2215945",
"https://errata.almalinux.org/9/ALSA-2023-6632.html",
"https://linux.oracle.com/cve/CVE-2023-4641.html",
"https://linux.oracle.com/errata/ELSA-2023-7112.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4641",
"https://ubuntu.com/security/notices/USN-6640-1",
"https://www.cve.org/CVERecord?id=CVE-2023-4641"
],
"PublishedDate": "2023-12-27T16:15:13.363Z",
"LastModifiedDate": "2024-11-21T08:35:35.837Z"
},
{
"VulnerabilityID": "CVE-2007-5686",
"PkgID": "passwd@1:4.13+dfsg1-1+b1",
"PkgName": "passwd",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "414b9b1c20179157"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...",
"Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.",
"Severity": "LOW",
"CweIDs": [
"CWE-264"
],
"VendorSeverity": {
"debian": 1,
"nvd": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"V2Score": 4.9
}
},
"References": [
"http://secunia.com/advisories/27215",
"http://www.securityfocus.com/archive/1/482129/100/100/threaded",
"http://www.securityfocus.com/archive/1/482857/100/0/threaded",
"http://www.securityfocus.com/bid/26048",
"http://www.vupen.com/english/advisories/2007/3474",
"https://issues.rpath.com/browse/RPL-1825"
],
"PublishedDate": "2007-10-28T17:08:00Z",
"LastModifiedDate": "2024-11-21T00:38:27.587Z"
},
{
"VulnerabilityID": "CVE-2023-29383",
"PkgID": "passwd@1:4.13+dfsg1-1+b1",
"PkgName": "passwd",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "414b9b1c20179157"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29383",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow: Improper input validation in shadow-utils package utility chfn",
"Description": "In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.",
"Severity": "LOW",
"CweIDs": [
"CWE-74",
"CWE-125"
],
"VendorSeverity": {
"cbl-mariner": 1,
"nvd": 1,
"photon": 1,
"redhat": 2,
"ubuntu": 1
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 3.3
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2023-29383",
"https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d",
"https://github.com/shadow-maint/shadow/pull/687",
"https://nvd.nist.gov/vuln/detail/CVE-2023-29383",
"https://www.cve.org/CVERecord?id=CVE-2023-29383",
"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/",
"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797"
],
"PublishedDate": "2023-04-14T22:15:07.68Z",
"LastModifiedDate": "2025-02-06T22:15:35.057Z"
},
{
"VulnerabilityID": "CVE-2024-56433",
"PkgID": "passwd@1:4.13+dfsg1-1+b1",
"PkgName": "passwd",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "414b9b1c20179157"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise",
"Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.",
"Severity": "LOW",
"CweIDs": [
"CWE-1188"
],
"VendorSeverity": {
"azure": 1,
"redhat": 1,
"ubuntu": 1
},
"CVSS": {
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 3.6
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2024-56433",
"https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241",
"https://github.com/shadow-maint/shadow/issues/1157",
"https://github.com/shadow-maint/shadow/releases/tag/4.4",
"https://nvd.nist.gov/vuln/detail/CVE-2024-56433",
"https://www.cve.org/CVERecord?id=CVE-2024-56433"
],
"PublishedDate": "2024-12-26T09:15:07.267Z",
"LastModifiedDate": "2024-12-26T09:15:07.267Z"
},
{
"VulnerabilityID": "TEMP-0628843-DBAD28",
"PkgID": "passwd@1:4.13+dfsg1-1+b1",
"PkgName": "passwd",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bb1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "414b9b1c20179157"
},
"InstalledVersion": "1:4.13+dfsg1-1+b1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "[more related to CVE-2005-4890]",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1
}
},
{
"VulnerabilityID": "CVE-2023-31484",
"PkgID": "perl-base@5.36.0-7+deb12u2",
"PkgName": "perl-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "170e64dcedbd4508"
},
"InstalledVersion": "5.36.0-7+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31484",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS",
"Description": "CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.",
"Severity": "HIGH",
"CweIDs": [
"CWE-295"
],
"VendorSeverity": {
"alma": 2,
"amazon": 3,
"cbl-mariner": 3,
"nvd": 3,
"oracle-oval": 2,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 8.1
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V3Score": 7.4
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2023/04/29/1",
"http://www.openwall.com/lists/oss-security/2023/05/03/3",
"http://www.openwall.com/lists/oss-security/2023/05/03/5",
"http://www.openwall.com/lists/oss-security/2023/05/07/2",
"https://access.redhat.com/errata/RHSA-2023:6539",
"https://access.redhat.com/security/cve/CVE-2023-31484",
"https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/",
"https://bugzilla.redhat.com/2218667",
"https://bugzilla.redhat.com/show_bug.cgi?id=2218667",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31484",
"https://errata.almalinux.org/9/ALSA-2023-6539.html",
"https://errata.rockylinux.org/RLSA-2023:6539",
"https://github.com/andk/cpanpm/commit/9c98370287f4e709924aee7c58ef21c85289a7f0 (2.35-TRIAL)",
"https://github.com/andk/cpanpm/pull/175",
"https://linux.oracle.com/cve/CVE-2023-31484.html",
"https://linux.oracle.com/errata/ELSA-2024-3094.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/",
"https://metacpan.org/dist/CPAN/changes",
"https://nvd.nist.gov/vuln/detail/CVE-2023-31484",
"https://security.netapp.com/advisory/ntap-20240621-0007/",
"https://ubuntu.com/security/notices/USN-6112-1",
"https://ubuntu.com/security/notices/USN-6112-2",
"https://www.cve.org/CVERecord?id=CVE-2023-31484",
"https://www.openwall.com/lists/oss-security/2023/04/18/14"
],
"PublishedDate": "2023-04-29T00:15:09Z",
"LastModifiedDate": "2024-11-21T08:01:57.707Z"
},
{
"VulnerabilityID": "CVE-2011-4116",
"PkgID": "perl-base@5.36.0-7+deb12u2",
"PkgName": "perl-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "170e64dcedbd4508"
},
"InstalledVersion": "5.36.0-7+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "perl: File:: Temp insecure temporary file handling",
"Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.",
"Severity": "LOW",
"CweIDs": [
"CWE-59"
],
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 1
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"V2Score": 1.9
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2011/11/04/2",
"http://www.openwall.com/lists/oss-security/2011/11/04/4",
"https://access.redhat.com/security/cve/CVE-2011-4116",
"https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14",
"https://nvd.nist.gov/vuln/detail/CVE-2011-4116",
"https://rt.cpan.org/Public/Bug/Display.html?id=69106",
"https://seclists.org/oss-sec/2011/q4/238",
"https://www.cve.org/CVERecord?id=CVE-2011-4116"
],
"PublishedDate": "2020-01-31T18:15:11.343Z",
"LastModifiedDate": "2024-11-21T01:31:52.77Z"
},
{
"VulnerabilityID": "CVE-2023-31486",
"PkgID": "perl-base@5.36.0-7+deb12u2",
"PkgName": "perl-base",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u2?arch=amd64\u0026distro=debian-12.10",
"UID": "170e64dcedbd4508"
},
"InstalledVersion": "5.36.0-7+deb12u2",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "http-tiny: insecure TLS cert default",
"Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.",
"Severity": "LOW",
"CweIDs": [
"CWE-295"
],
"VendorSeverity": {
"alma": 2,
"amazon": 3,
"cbl-mariner": 3,
"debian": 1,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 8.1
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"V3Score": 6.8
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2023/04/29/1",
"http://www.openwall.com/lists/oss-security/2023/05/03/3",
"http://www.openwall.com/lists/oss-security/2023/05/03/5",
"http://www.openwall.com/lists/oss-security/2023/05/07/2",
"https://access.redhat.com/errata/RHSA-2023:6542",
"https://access.redhat.com/security/cve/CVE-2023-31486",
"https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/",
"https://bugzilla.redhat.com/2228392",
"https://errata.almalinux.org/9/ALSA-2023-6542.html",
"https://github.com/chansen/p5-http-tiny/pull/153",
"https://hackeriet.github.io/cpan-http-tiny-overview/",
"https://linux.oracle.com/cve/CVE-2023-31486.html",
"https://linux.oracle.com/errata/ELSA-2023-7174.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-31486",
"https://security.netapp.com/advisory/ntap-20241129-0011/",
"https://www.cve.org/CVERecord?id=CVE-2023-31486",
"https://www.openwall.com/lists/oss-security/2023/04/18/14",
"https://www.openwall.com/lists/oss-security/2023/05/03/4",
"https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/"
],
"PublishedDate": "2023-04-29T00:15:09.083Z",
"LastModifiedDate": "2025-01-30T20:15:32.297Z"
},
{
"VulnerabilityID": "TEMP-0517018-A83CE6",
"PkgID": "sysvinit-utils@3.06-4",
"PkgName": "sysvinit-utils",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64\u0026distro=debian-12.10",
"UID": "aab9a8419e8391fc"
},
"InstalledVersion": "3.06-4",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0517018-A83CE6",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "[sysvinit: no-root option in expert installer exposes locally exploitable security flaw]",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1
}
},
{
"VulnerabilityID": "CVE-2005-2541",
"PkgID": "tar@1.34+dfsg-1.2+deb12u1",
"PkgName": "tar",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "40d3e19c8515b967"
},
"InstalledVersion": "1.34+dfsg-1.2+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2005-2541",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "tar: does not properly warn the user when extracting setuid or setgid files",
"Description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1,
"nvd": 3,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"V2Score": 10
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"V3Score": 7
}
},
"References": [
"http://marc.info/?l=bugtraq\u0026m=112327628230258\u0026w=2",
"https://access.redhat.com/security/cve/CVE-2005-2541",
"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2005-2541",
"https://www.cve.org/CVERecord?id=CVE-2005-2541"
],
"PublishedDate": "2005-08-10T04:00:00Z",
"LastModifiedDate": "2025-04-03T01:03:51.193Z"
},
{
"VulnerabilityID": "TEMP-0290435-0B57B5",
"PkgID": "tar@1.34+dfsg-1.2+deb12u1",
"PkgName": "tar",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.10",
"UID": "40d3e19c8515b967"
},
"InstalledVersion": "1.34+dfsg-1.2+deb12u1",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0290435-0B57B5",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "[tar's rmt command may have undesired side effects]",
"Severity": "LOW",
"VendorSeverity": {
"debian": 1
}
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "util-linux@2.38.1-5+deb12u3",
"PkgName": "util-linux",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "7baf07217f173406"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2022-0563",
"PkgID": "util-linux-extra@2.38.1-5+deb12u3",
"PkgName": "util-linux-extra",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.10",
"UID": "30ac64362504313"
},
"InstalledVersion": "2.38.1-5+deb12u3",
"Status": "affected",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "debian",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline",
"Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
"Severity": "LOW",
"CweIDs": [
"CWE-209"
],
"VendorSeverity": {
"amazon": 2,
"cbl-mariner": 2,
"debian": 1,
"nvd": 2,
"photon": 2,
"redhat": 2
},
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 5.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0563",
"https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u",
"https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0563",
"https://security.gentoo.org/glsa/202401-08",
"https://security.netapp.com/advisory/ntap-20220331-0002/",
"https://www.cve.org/CVERecord?id=CVE-2022-0563"
],
"PublishedDate": "2022-02-21T19:15:08.393Z",
"LastModifiedDate": "2024-11-21T06:38:55.503Z"
},
{
"VulnerabilityID": "CVE-2023-45853",
"PkgID": "zlib1g@1:1.2.13.dfsg-1",
"PkgName": "zlib1g",
"PkgIdentifier": {
"PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.10\u0026epoch=1",
"UID": "a68dc3e936e6a0f7"
},
"InstalledVersion": "1:1.2.13.dfsg-1",
"Status": "will_not_fix",
"Layer": {
"Digest": "sha256:254e724d77862dc53abbd3bf0e27f9d2f64293909cdd3d0aad6a8fe5a6680659",
"DiffID": "sha256:6c4c763d22d0c5f9b2c5901dfa667fbbc4713cee6869336b8fd5022185071f1c"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45853",
"DataSource": {
"ID": "debian",
"Name": "Debian Security Tracker",
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
},
"Title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6",
"Description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.",
"Severity": "CRITICAL",
"CweIDs": [
"CWE-190"
],
"VendorSeverity": {
"amazon": 2,
"azure": 4,
"cbl-mariner": 4,
"ghsa": 4,
"nvd": 4,
"photon": 4,
"redhat": 2,
"ubuntu": 2
},
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 9.8
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 9.8
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"V3Score": 5.3
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2023/10/20/9",
"http://www.openwall.com/lists/oss-security/2024/01/24/10",
"https://access.redhat.com/security/cve/CVE-2023-45853",
"https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356",
"https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4",
"https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c",
"https://github.com/madler/zlib/pull/843",
"https://github.com/smihica/pyminizip",
"https://github.com/smihica/pyminizip/blob/master/zlib-1.2.11/contrib/minizip/zip.c",
"https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-45853",
"https://pypi.org/project/pyminizip/#history",
"https://security.gentoo.org/glsa/202401-18",
"https://security.netapp.com/advisory/ntap-20231130-0009",
"https://security.netapp.com/advisory/ntap-20231130-0009/",
"https://ubuntu.com/security/notices/USN-7107-1",
"https://www.cve.org/CVERecord?id=CVE-2023-45853",
"https://www.winimage.com/zLibDll/minizip.html"
],
"PublishedDate": "2023-10-14T02:15:09.323Z",
"LastModifiedDate": "2024-12-20T17:41:31.237Z"
}
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink