CVE-2026-8376
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.
A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-8376
- https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch
- http://www.openwall.com/lists/oss-security/2026/05/26/1
CVE-2026-42496
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.
_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.
A subsequent open through the extracted name reads or writes the attacker chosen path.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-42496
- https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
- https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
- https://www.cve.org/CVERecord?id=CVE-2026-42497
- https://access.redhat.com/errata/RHSA-2026:30851
- https://access.redhat.com/errata/RHSA-2026:30852
- https://access.redhat.com/errata/RHSA-2026:30856
- https://access.redhat.com/errata/RHSA-2026:30857
- https://access.redhat.com/security/cve/CVE-2026-42496
- https://bugzilla.redhat.com/show_bug.cgi?id=2481314
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json
CVE-2026-13221
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-13221
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
- https://github.com/Perl/perl5/issues/23388
- http://www.openwall.com/lists/oss-security/2026/07/13/5
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Remediation
There is no fixed version for Debian:13 zlib.
References
- https://security-tracker.debian.org/tracker/CVE-2026-85091
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
Remediation
Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-11822
- https://sqlite.org/releaselog/3_53_2.html
- https://sqlite.org/src/info/061febcf41ca
- https://sqlite.org/src/info/4a5ad516ea93
- https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
Remediation
Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-11824
- https://sqlite.org/releaselog/3_53_2.html
- https://sqlite.org/src/info/061febcf41ca
- https://sqlite.org/src/info/4a5ad516ea93
- https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate
CVE-2026-42497
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-42497
- https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
- https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
- https://www.cve.org/CVERecord?id=CVE-2026-42496
CVE-2026-57432
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-57432
- https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
- http://www.openwall.com/lists/oss-security/2026/07/13/6
Free of Memory not on the Heap
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Remediation
Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-89161
- https://github.com/PCRE2Project/pcre2/pull/937
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Remediation
Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-89157
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9
Integer Coercion Error
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86143
- https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
- https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86139
- https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
Stack-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86140
- https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86142
- https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
- https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
Incorrect Resource Transfer Between Spheres
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86144
- https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-86138
- https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
Release of Invalid Pointer or Reference
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
Remediation
There is no fixed version for Debian:13 libxml2.
References
- https://security-tracker.debian.org/tracker/CVE-2026-74860
- https://access.redhat.com/security/cve/CVE-2026-74860
- https://bugzilla.redhat.com/show_bug.cgi?id=2529697
- https://access.redhat.com/errata/RHSA-2026:64463
Buffer Over-read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.
This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.
Remediation
Upgrade Debian:13 gzip to version 1.13-1+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-41992
- https://cert.pl/en/posts/2026/04/CVE-2026-41991/
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
- https://www.gnu.org/software/gzip/
- http://www.openwall.com/lists/oss-security/2026/08/23/1
- http://www.openwall.com/lists/oss-security/2026/08/25/1
- http://www.openwall.com/lists/oss-security/2026/08/27/2
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Remediation
There is no fixed version for Debian:13 attr.
References
- https://security-tracker.debian.org/tracker/CVE-2026-54371
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
- https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
- https://access.redhat.com/security/cve/CVE-2026-54371
- https://bugzilla.redhat.com/show_bug.cgi?id=2490283
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
- https://access.redhat.com/errata/RHSA-2026:34889
- https://access.redhat.com/errata/RHSA-2026:56133
- https://access.redhat.com/errata/RHSA-2026:59380
- https://access.redhat.com/errata/RHSA-2026:60226
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:63135
- https://access.redhat.com/errata/RHSA-2026:63138
- https://access.redhat.com/errata/RHSA-2026:66018
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
Remediation
There is no fixed version for Debian:13 acl.
References
- https://security-tracker.debian.org/tracker/CVE-2026-54369
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
- https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
- https://access.redhat.com/errata/RHSA-2026:34351
- https://access.redhat.com/errata/RHSA-2026:42736
- https://access.redhat.com/errata/RHSA-2026:42739
- https://access.redhat.com/errata/RHSA-2026:43420
- https://access.redhat.com/security/cve/CVE-2026-54369
- https://bugzilla.redhat.com/show_bug.cgi?id=2490277
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json
- https://access.redhat.com/errata/RHSA-2026:44481
- https://access.redhat.com/errata/RHSA-2026:46836
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:53371
- https://access.redhat.com/errata/RHSA-2026:54769
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:64805
- https://access.redhat.com/errata/RHSA-2026:67140
- https://access.redhat.com/errata/RHSA-2026:67142
- https://access.redhat.com/errata/RHSA-2026:67144