{ "vulnerabilities": [ { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "acl/libacl1@2.3.2-2+dhi1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+dhi1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "coreutils@9.7-3+dhi4", "acl/libacl1@2.3.2-2+dhi1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+dhi1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "sed@4.9-2+deb13u1+dhi1", "acl/libacl1@2.3.2-2+dhi1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+dhi1" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "attr/libattr1@1:2.5.2-3+dhi1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3+dhi1" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "coreutils@9.7-3+dhi4", "attr/libattr1@1:2.5.2-3+dhi1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3+dhi1" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+dhi4" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "libzstd/zstd@1.5.7+dfsg-1+dhi2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+dhi4" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "mariadb-10.11@10.11.19-2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+dhi4" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "perl/libperl5.40@5.40.1-6+deb13u1+dhi2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+dhi4" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|dhi.io/mariadb@10-debian", "coreutils@9.7-3+dhi4", "openssl/libssl3t64@3.5.7-1~deb13u3+dhi0", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+dhi4" } ], "ok": false, "dependencyCount": 55, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Docker Hardened Images/Debian GNU/Linux 13 (trixie)" } }, "summary": "10 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 3, "projectName": "docker-image|dhi.io/mariadb", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "dhi.io/mariadb:10-debian/mariadb", "applications": [ { "vulnerabilities": [], "ok": true, "dependencyCount": 3, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/gosu", "projectName": "github.com/tianon/gosu", "displayTargetFile": "/usr/bin/gosu", "hasUnknownVersions": false, "path": "dhi.io/mariadb:10-debian/tianon/gosu" } ] }