Snyk test report

Out-of-bounds Write

high severity

Exploit: Not Defined

Package Manager: debian:13
Vulnerable module: zlib/zlib1g
Introduced through: docker-image|dhi.io/mariadb@10-debian and zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4

Detailed paths

Introduced through: docker-image|dhi.io/mariadb@10-debian › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4
Introduced through: docker-image|dhi.io/mariadb@10-debian › libzstd/zstd@1.5.7+dfsg-1+dhi2 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4
Introduced through: docker-image|dhi.io/mariadb@10-debian › mariadb-10.11@10.11.19-2 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4
Introduced through: docker-image|dhi.io/mariadb@10-debian › perl/libperl5.40@5.40.1-6+deb13u1+dhi2 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4
Introduced through: docker-image|dhi.io/mariadb@10-debian › coreutils@9.7-3+dhi4 › openssl/libssl3t64@3.5.7-1~deb13u3+dhi0 › zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+dhi4

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

There is no fixed version for Debian:13 zlib.

References

More about this vulnerability

Link Following

high severity

Exploit: Not Defined

Package Manager: debian:13
Vulnerable module: attr/libattr1
Introduced through: docker-image|dhi.io/mariadb@10-debian and attr/libattr1@1:2.5.2-3+dhi1

Detailed paths

Introduced through: docker-image|dhi.io/mariadb@10-debian › attr/libattr1@1:2.5.2-3+dhi1
Introduced through: docker-image|dhi.io/mariadb@10-debian › coreutils@9.7-3+dhi4 › attr/libattr1@1:2.5.2-3+dhi1

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

There is no fixed version for Debian:13 attr.

References

More about this vulnerability

Link Following

high severity

Exploit: Not Defined

Package Manager: debian:13
Vulnerable module: acl/libacl1
Introduced through: docker-image|dhi.io/mariadb@10-debian and acl/libacl1@2.3.2-2+dhi1

Detailed paths

Introduced through: docker-image|dhi.io/mariadb@10-debian › acl/libacl1@2.3.2-2+dhi1
Introduced through: docker-image|dhi.io/mariadb@10-debian › coreutils@9.7-3+dhi4 › acl/libacl1@2.3.2-2+dhi1
Introduced through: docker-image|dhi.io/mariadb@10-debian › sed@4.9-2+deb13u1+dhi1 › acl/libacl1@2.3.2-2+dhi1

NVD Description

Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Remediation

There is no fixed version for Debian:13 acl.

References

More about this vulnerability