| Project | docker-image|docker.io/qdrant/qdrant |
|---|---|
| Path | docker.io/qdrant/qdrant:v1.17.1/qdrant/qdrant |
| Package Manager | deb |
CVE-2026-8376
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.
A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-8376
- https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch
- http://www.openwall.com/lists/oss-security/2026/05/26/1
CVE-2026-42496
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.
_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.
A subsequent open through the extracted name reads or writes the attacker chosen path.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-42496
- https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
- https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
- https://www.cve.org/CVERecord?id=CVE-2026-42497
- https://access.redhat.com/errata/RHSA-2026:30851
- https://access.redhat.com/errata/RHSA-2026:30852
- https://access.redhat.com/errata/RHSA-2026:30856
- https://access.redhat.com/errata/RHSA-2026:30857
- https://access.redhat.com/security/cve/CVE-2026-42496
- https://bugzilla.redhat.com/show_bug.cgi?id=2481314
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json
CVE-2026-13221
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-13221
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
- https://github.com/Perl/perl5/issues/23388
- http://www.openwall.com/lists/oss-security/2026/07/13/5
CVE-2026-31789
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.
Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior.
If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow.
Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Remediation
Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-31789
- https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde
- https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf
- https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49
- https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9
- https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521
- https://openssl-library.org/news/secadv/20260407.txt
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Remediation
There is no fixed version for Debian:13 zlib.
References
- https://security-tracker.debian.org/tracker/CVE-2026-85091
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
Remediation
Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-11822
- https://sqlite.org/releaselog/3_53_2.html
- https://sqlite.org/src/info/061febcf41ca
- https://sqlite.org/src/info/4a5ad516ea93
- https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
Remediation
Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-11824
- https://sqlite.org/releaselog/3_53_2.html
- https://sqlite.org/src/info/061febcf41ca
- https://sqlite.org/src/info/4a5ad516ea93
- https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate
CVE-2026-42497
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-42497
- https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
- https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
- https://www.cve.org/CVERecord?id=CVE-2026-42496
CVE-2026-57432
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Remediation
Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-57432
- https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
- http://www.openwall.com/lists/oss-security/2026/07/13/6
Free of Memory not on the Heap
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Remediation
Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-89161
- https://github.com/PCRE2Project/pcre2/pull/937
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Remediation
Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-89157
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9
CVE-2026-28389
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Remediation
Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-28389
- https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5
- https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616
- https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f
- https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a
- https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686
- https://openssl-library.org/news/secadv/20260407.txt
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
CVE-2026-28387
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.
Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.
However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.
By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.
The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.
No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.
Remediation
Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-28387
- https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b
- https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe
- https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3
- https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7
- https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177
- https://openssl-library.org/news/secadv/20260407.txt
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
CVE-2026-28390
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Remediation
Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-28390
- https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc
- https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6
- https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4
- https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788
- https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75
- https://openssl-library.org/news/secadv/20260407.txt
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
CVE-2026-28388
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.
The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Remediation
Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-28388
- https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
- https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139
- https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3
- https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8
- https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726
- https://openssl-library.org/news/secadv/20260407.txt
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Time-of-check Time-of-use (TOCTOU)
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libcap2 package and not the libcap2 package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Remediation
Upgrade Debian:13 libcap2 to version 1:2.75-10+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-4878
- https://bugzilla.redhat.com/show_bug.cgi?id=2447554
- http://www.openwall.com/lists/oss-security/2026/04/07/14
- http://www.openwall.com/lists/oss-security/2026/04/07/4
- http://www.openwall.com/lists/oss-security/2026/04/08/9
- http://www.openwall.com/lists/oss-security/2026/04/09/5
- http://www.openwall.com/lists/oss-security/2026/04/09/6
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json
- https://access.redhat.com/errata/RHSA-2026:12423
- https://access.redhat.com/errata/RHSA-2026:12441
- https://access.redhat.com/errata/RHSA-2026:13285
- https://access.redhat.com/errata/RHSA-2026:14162
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:19130
- https://access.redhat.com/errata/RHSA-2026:19346
- https://access.redhat.com/errata/RHSA-2026:19456
- https://access.redhat.com/errata/RHSA-2026:19458
- https://access.redhat.com/errata/RHSA-2026:20595
- https://access.redhat.com/errata/RHSA-2026:21254
- https://access.redhat.com/errata/RHSA-2026:21275
- https://access.redhat.com/errata/RHSA-2026:22634
- https://access.redhat.com/errata/RHSA-2026:22957
- https://access.redhat.com/errata/RHSA-2026:23233
- https://access.redhat.com/errata/RHSA-2026:23245
- https://access.redhat.com/errata/RHSA-2026:24346
- https://access.redhat.com/errata/RHSA-2026:25044
- https://access.redhat.com/errata/RHSA-2026:25096
- https://access.redhat.com/errata/RHSA-2026:25181
- https://access.redhat.com/errata/RHSA-2026:26542
- https://access.redhat.com/errata/RHSA-2026:27998
- https://access.redhat.com/errata/RHSA-2026:28887
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:30078
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:34098
- https://access.redhat.com/errata/RHSA-2026:39981
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:59831
- https://access.redhat.com/errata/RHSA-2026:7473
- https://access.redhat.com/security/cve/CVE-2026-4878
- https://bugzilla.redhat.com/show_bug.cgi?id=2451615
Buffer Over-read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.
This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.
Remediation
Upgrade Debian:13 gzip to version 1.13-1+deb13u1 or higher.
References
- https://security-tracker.debian.org/tracker/CVE-2026-41992
- https://cert.pl/en/posts/2026/04/CVE-2026-41991/
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
- https://www.gnu.org/software/gzip/
- http://www.openwall.com/lists/oss-security/2026/08/23/1
- http://www.openwall.com/lists/oss-security/2026/08/25/1
- http://www.openwall.com/lists/oss-security/2026/08/27/2
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Remediation
There is no fixed version for Debian:13 attr.
References
- https://security-tracker.debian.org/tracker/CVE-2026-54371
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
- https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
- https://access.redhat.com/security/cve/CVE-2026-54371
- https://bugzilla.redhat.com/show_bug.cgi?id=2490283
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
- https://access.redhat.com/errata/RHSA-2026:34889
- https://access.redhat.com/errata/RHSA-2026:56133
- https://access.redhat.com/errata/RHSA-2026:59380
- https://access.redhat.com/errata/RHSA-2026:60226
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:63135
- https://access.redhat.com/errata/RHSA-2026:63138
- https://access.redhat.com/errata/RHSA-2026:66018
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
Remediation
There is no fixed version for Debian:13 acl.
References
- https://security-tracker.debian.org/tracker/CVE-2026-54369
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
- https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
- https://access.redhat.com/errata/RHSA-2026:34351
- https://access.redhat.com/errata/RHSA-2026:42736
- https://access.redhat.com/errata/RHSA-2026:42739
- https://access.redhat.com/errata/RHSA-2026:43420
- https://access.redhat.com/security/cve/CVE-2026-54369
- https://bugzilla.redhat.com/show_bug.cgi?id=2490277
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json
- https://access.redhat.com/errata/RHSA-2026:44481
- https://access.redhat.com/errata/RHSA-2026:46836
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:53371
- https://access.redhat.com/errata/RHSA-2026:54769
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:64805
- https://access.redhat.com/errata/RHSA-2026:67140
- https://access.redhat.com/errata/RHSA-2026:67142
- https://access.redhat.com/errata/RHSA-2026:67144