Snyk - Open Source Security

Snyk test report

September 11th 2026, 6:21:18 pm (UTC+00:00)

Scanned the following paths:
  • docker.io/postgres:17.10/postgres (deb)
  • docker.io/postgres:17.10/tianon/gosu//usr/local/bin/gosu (gomodules)
4 known vulnerabilities
19 vulnerable dependency paths
145 dependencies

Out-of-bounds Write

high severity
Exploit: Not Defined
  • Package Manager: debian:13
  • Vulnerable module: zlib/zlib1g
  • Introduced through: docker-image|docker.io/postgres@17.10, dpkg@1.22.22 and others

Detailed paths

  • Introduced through: docker-image|docker.io/postgres@17.10 › dpkg@1.22.22 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › libzstd/zstd@1.5.7+dfsg-1 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › perl/libperl5.40@5.40.1-6 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › apt@3.0.3 › apt/libapt-pkg7.0@3.0.3 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › gnupg2/gnupg@2.4.7-21+deb13u1 › gnupg2/gpg@2.4.7-21+deb13u1+b4 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › llvm-toolchain-19/libllvm19@1:19.1.7-3+b1 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › postgresql-17/postgresql-client-17@17.10-1.pgdg13+1 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › llvm-toolchain-19/libllvm19@1:19.1.7-3+b1 › libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › gnupg2/gnupg@2.4.7-21+deb13u1 › gnupg2/dirmngr@2.4.7-21+deb13u1+b4 › openldap/libldap2@2.6.10+dfsg-1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9 › openssl/libssl3t64@3.5.6-1~deb13u2 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

There is no fixed version for Debian:13 zlib.

References

More about this vulnerability

Release of Invalid Pointer or Reference

high severity
Exploit: Not Defined
  • Package Manager: debian:13
  • Vulnerable module: libxml2
  • Introduced through: docker-image|docker.io/postgres@17.10, postgresql-17@17.10-1.pgdg13+1 and others

Detailed paths

  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › libxslt/libxslt1.1@1.1.35-1.2+deb13u3 › libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
  • Introduced through: docker-image|docker.io/postgres@17.10 › postgresql-17@17.10-1.pgdg13+1 › llvm-toolchain-19/libllvm19@1:19.1.7-3+b1 › libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Remediation

There is no fixed version for Debian:13 libxml2.

References

More about this vulnerability

Link Following

high severity
Exploit: Not Defined
  • Package Manager: debian:13
  • Vulnerable module: attr/libattr1
  • Introduced through: docker-image|docker.io/postgres@17.10, coreutils@9.7-3 and others

Detailed paths

  • Introduced through: docker-image|docker.io/postgres@17.10 › coreutils@9.7-3 › attr/libattr1@1:2.5.2-3
  • Introduced through: docker-image|docker.io/postgres@17.10 › gnupg2/gnupg@2.4.7-21+deb13u1 › gnupg2/dirmngr@2.4.7-21+deb13u1+b4 › adduser@3.152 › shadow/passwd@1:4.17.4-2 › attr/libattr1@1:2.5.2-3

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

There is no fixed version for Debian:13 attr.

References

More about this vulnerability

Link Following

high severity
Exploit: Not Defined
  • Package Manager: debian:13
  • Vulnerable module: acl/libacl1
  • Introduced through: docker-image|docker.io/postgres@17.10, coreutils@9.7-3 and others

Detailed paths

  • Introduced through: docker-image|docker.io/postgres@17.10 › coreutils@9.7-3 › acl/libacl1@2.3.2-2+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › sed@4.9-2+deb13u1 › acl/libacl1@2.3.2-2+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › dpkg@1.22.22 › tar@1.35+dfsg-3.1 › acl/libacl1@2.3.2-2+b1
  • Introduced through: docker-image|docker.io/postgres@17.10 › gnupg2/gnupg@2.4.7-21+deb13u1 › gnupg2/dirmngr@2.4.7-21+deb13u1+b4 › adduser@3.152 › shadow/passwd@1:4.17.4-2 › acl/libacl1@2.3.2-2+b1

NVD Description

Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Remediation

There is no fixed version for Debian:13 acl.

References

More about this vulnerability