Sign pip-audit PR commits

[thalassemia]

The security update commits created by the bash script I added in #397 are currently unsigned, meaning they cannot be merged without manual signing. In this PR, I add the logic necessary to automatically sign the created commits using GitHub's REST API.

For posterity, the reason I care so much about securing this particular GitHub Action workflow (to the point where I replaced a much simpler third-party action with all this custom scripting) is because it is the only one that has write access to the repo. It needs this to commit security updates and create PRs. While convenient for us, this means that if an attacker compromises any part of the workflow, they can gain write access to the repo.

Right now, assuming first-party GitHub tools can be trusted, the only other obvious vulnerability to me was the fact that I did not pin the versions of pip-audit and packaging used in the workflow. Theoretically, malicious versions of those packages could get installed, compromising the repo. This PR fixes that by pinning them to specific versions and also running pip-audit on the environment with both installed to check that neither they nor their dependencies have known vulnerabilities.

[github-actions]

🔍 Vulnerabilities of vecoli:latest

📦 Image Reference vecoli:latest

digest	sha256:aeeb359b63fe84d62ebeacaf663159ab40bdccade098f219d198be361a55bd00
vulnerabilities
platform	linux/amd64
size	966 MB
packages	399

📦 Base Image debian:13-slim

also known as	13.3-slim trixie-20260112-slim trixie-slim
digest	sha256:ef514b33e858a6ddd5a2af2b50f08f7ff2e43726a14d5f53bdb1d75220dfa5fb
vulnerabilities

openssl 3.5.5-1~deb13u1 (deb) pkg:deb/debian/openssl@3.5.5-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. openssl https://openssl-library.org/news/secadv/20260407.txt Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 EPSS Score 0.045% EPSS Percentile 14th percentile Description Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. openssl (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130650) [trixie] - openssl 3.5.5-1~deb13u2 [bookworm] - openssl (Only affects 3.5 and later) [bullseye] - openssl (Only affects 3.5 and later) https://openssl-library.org/news/secadv/20260313.txt Fixed by: openssl/openssl@85977e0 (openssl-3.5.6) Fixed by: openssl/openssl@2157c9d (openssl-3.6.2) Affected range >=3.2.1-3 Fixed version Not Fixed EPSS Score 0.094% EPSS Percentile 26th percentile Description OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack." http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf openssl/openssl#24540 Fault injection based attacks are not within OpenSSLs threat model according to the security policy: https://www.openssl.org/policies/general/security-policy.html Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. openssl https://openssl-library.org/news/secadv/20260407.txt Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. openssl https://openssl-library.org/news/secadv/20260407.txt Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. openssl https://openssl-library.org/news/secadv/20260407.txt Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. openssl https://openssl-library.org/news/secadv/20260407.txt Affected range <3.5.5-1~deb13u2 Fixed version 3.5.5-1~deb13u2 Description Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary. openssl https://openssl-library.org/news/secadv/20260407.txt

nghttp2 1.64.0-1.1 (deb) pkg:deb/debian/nghttp2@1.64.0-1.1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1.64.0-1.1 Fixed version Not Fixed EPSS Score 0.017% EPSS Percentile 4th percentile Description nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available. nghttp2 1.68.1-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131369) GHSA-6933-cjhr-5qg6 Fixed by: nghttp2/nghttp2@5c7df8f (v1.68.1)

aiohttp 3.13.3 (pypi) pkg:pypi/aiohttp@3.13.3 Uncontrolled Resource Consumption Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.052% EPSS Percentile 16th percentile Description Summary Insufficient restrictions in header/trailer handling could cause uncapped memory usage. Impact An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration. Patch: aio-libs/aiohttp@0c2e9da Allocation of Resources Without Limits or Throttling Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.050% EPSS Percentile 15th percentile Description Summary A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. Impact Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability. Patch: aio-libs/aiohttp@8a74257 Absolute Path Traversal Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U EPSS Score 0.076% EPSS Percentile 23rd percentile Description Summary On Windows the static resource handler may expose information about a NTLMv2 remote path. Impact If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there. Patch: aio-libs/aiohttp@0ae2aa0 Improper Input Validation Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 6.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N EPSS Score 0.100% EPSS Percentile 28th percentile Description Summary Multiple Host headers were allowed in aiohttp. Impact Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using Application.add_domain(). Patch: aio-libs/aiohttp@e00ca3c Patch: aio-libs/aiohttp@53e2e6f Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U EPSS Score 0.055% EPSS Percentile 17th percentile Description Summary The C parser (the default for most installs) accepted null bytes and control characters is response headers. Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin() may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass. Patch: aio-libs/aiohttp@9370b97 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U EPSS Score 0.059% EPSS Percentile 18th percentile Description Summary An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. Impact In the unlikely situation that an application allows untrusted data to be used in the response's reason parameter, then an attacker could manipulate the response to send something different from what the developer intended. Patch: aio-libs/aiohttp@53b35a2 Exposure of Sensitive Information to an Unauthorized Actor Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U EPSS Score 0.052% EPSS Percentile 16th percentile Description Summary When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. Impact The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect. Patch: aio-libs/aiohttp@5351c98 Allocation of Resources Without Limits or Throttling Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U EPSS Score 0.052% EPSS Percentile 16th percentile Description Summary For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. Impact If an application uses Request.post() an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected. Patch: aio-libs/aiohttp@cbb774f Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U EPSS Score 0.059% EPSS Percentile 18th percentile Description Summary An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. Impact If an application allows untrusted data to be used for the multipart content_type parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended. Patch: aio-libs/aiohttp@9a6ada9 Allocation of Resources Without Limits or Throttling Affected range <=3.13.3 Fixed version 3.13.4 CVSS Score 2.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U EPSS Score 0.052% EPSS Percentile 16th percentile Description Summary An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. Impact If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory. Patch: aio-libs/aiohttp@c4d77c3

tar 1.35+dfsg-3.1 (deb) pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1.35+dfsg-3.1 Fixed version Not Fixed EPSS Score 0.025% EPSS Percentile 7th percentile Description A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. tar https://bugzilla.redhat.com/show_bug.cgi?id=2455360 Affected range >=1.35+dfsg-3.1 Fixed version Not Fixed EPSS Score 0.083% EPSS Percentile 24th percentile Description GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). Disputed tar issue, works as documented per upstream: https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md Affected range <=1.35+dfsg-3.1 Fixed version Not Fixed EPSS Score 3.344% EPSS Percentile 87th percentile Description Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. This is intended behaviour, after all tar is an archiving tool and you need to give -p as a command line flag tar (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328228; unimportant)

requests 2.32.4 (pypi) pkg:pypi/requests@2.32.4 Insecure Temporary File Affected range <2.33.0 Fixed version 2.33.0 CVSS Score 4.4 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N EPSS Score 0.004% EPSS Percentile 0th percentile Description Impact The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Affected usages Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

biopython 1.85 (pypi) pkg:pypi/biopython@1.85 Improper Restriction of XML External Entity Reference Affected range <=1.86 Fixed version Not Fixed CVSS Score 4.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L EPSS Score 0.051% EPSS Percentile 16th percentile Description Bio.Entrez in Biopython through 1.86 allows doctype XXE.

binutils 2.44-3 (deb) pkg:deb/debian/binutils@2.44-3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.012% EPSS Percentile 2nd percentile Description A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33919 Fixed by: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9e99dbc1f19ffaf18d0250788951706066ebe7f2 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.005% EPSS Percentile 0th percentile Description A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service. binutils (unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2443828 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.005% EPSS Percentile 0th percentile Description A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service. binutils (unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2443826 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.024% EPSS Percentile 6th percentile Description A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.021% EPSS Percentile 6th percentile Description A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b https://sourceware.org/bugzilla/show_bug.cgi?id=33050 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.023% EPSS Percentile 6th percentile Description A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33049 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.016% EPSS Percentile 4th percentile Description GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33701 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=44b79abd0fa12e7947252eb4c6e5d16ed6033e01 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.005% EPSS Percentile 0th percentile Description GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33700 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.110% EPSS Percentile 29th percentile Description GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33698 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.033% EPSS Percentile 10th percentile Description GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33697 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.015% EPSS Percentile 3rd percentile Description GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33641 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.016% EPSS Percentile 4th percentile Description GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33640 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.006% EPSS Percentile 0th percentile Description Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33638 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.005% EPSS Percentile 0th percentile Description Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33637 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdb728d4da6184631989b192f1022c219dea7677 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.006% EPSS Percentile 0th percentile Description An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33639 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.016% EPSS Percentile 4th percentile Description An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.076% EPSS Percentile 23rd percentile Description An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.049% EPSS Percentile 15th percentile Description An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.076% EPSS Percentile 23rd percentile Description An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.076% EPSS Percentile 23rd percentile Description A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.023% EPSS Percentile 6th percentile Description An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file. binutils (unimportant) binutils not covered by security support and most certainly bogus since they were assigned for a very old binutils release Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.084% EPSS Percentile 24th percentile Description A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32829 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.081% EPSS Percentile 24th percentile Description A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32858 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d1458933830456e54223d9fc61f0d9b3a19256f5 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.068% EPSS Percentile 21st percentile Description A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32716 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.028% EPSS Percentile 8th percentile Description A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33455 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.017% EPSS Percentile 4th percentile Description A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33448 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=12ef7d5b7b02d0023db645d86eb9d0797bc747fe (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.104% EPSS Percentile 28th percentile Description A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32644 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.117% EPSS Percentile 31st percentile Description A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32643 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.082% EPSS Percentile 24th percentile Description A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32642 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.120% EPSS Percentile 31st percentile Description A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32638 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.213% EPSS Percentile 44th percentile Description A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue. binutils 2.45-3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108986) https://sourceware.org/bugzilla/show_bug.cgi?id=32636 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.087% EPSS Percentile 25th percentile Description A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32603 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.051% EPSS Percentile 16th percentile Description A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.078% EPSS Percentile 23rd percentile Description A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.048% EPSS Percentile 15th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.026% EPSS Percentile 7th percentile Description A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33502 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.034% EPSS Percentile 10th percentile Description A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33499 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.051% EPSS Percentile 16th percentile Description A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.072% EPSS Percentile 22nd percentile Description A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32576 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.067% EPSS Percentile 21st percentile Description A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. binutils 2.45-3 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=32556 binutils not covered by security support These were fixed in master, so 2.45 at the time Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.026% EPSS Percentile 7th percentile Description A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33450 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.025% EPSS Percentile 7th percentile Description A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33452 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.026% EPSS Percentile 7th percentile Description A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33452 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.024% EPSS Percentile 6th percentile Description A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46". binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33457 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.021% EPSS Percentile 6th percentile Description A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46". binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33464 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8 (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.026% EPSS Percentile 7th percentile Description A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue. binutils 2.46-1 (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=33406 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b (binutils-2_46) binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.162% EPSS Percentile 37th percentile Description An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c. binutils (unimportant) https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1927070 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.385% EPSS Percentile 60th percentile Description An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression. binutils (unimportant) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.801% EPSS Percentile 74th percentile Description A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt. binutils (unimportant) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629 https://sourceware.org/bugzilla/show_bug.cgi?id=24043 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.119% EPSS Percentile 31st percentile Description The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=24039 binutils not covered by security support Affected range <=2.44-3 Fixed version Not Fixed EPSS Score 0.237% EPSS Percentile 47th percentile Description The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd). binutils (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=22009 Underlying bug is though in the C++ demangler part of libiberty, but MITRE has assigned it specifically to the issue as raised within binutils. binutils not covered by security support

glibc 2.41-12+deb13u2 (deb) pkg:deb/debian/glibc@2.41-12%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.790% EPSS Percentile 74th percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern glibc (unimportant) eglibc (unimportant) https://sourceware.org/bugzilla/show_bug.cgi?id=24269 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.856% EPSS Percentile 75th percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22853 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.646% EPSS Percentile 71st percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22852 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.313% EPSS Percentile 54th percentile Description GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22851 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.131% EPSS Percentile 33rd percentile Description GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. glibc (unimportant) Not treated as a security issue by upstream https://sourceware.org/bugzilla/show_bug.cgi?id=22850 Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 1.492% EPSS Percentile 81st percentile Description In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep. glibc (unimportant) eglibc (unimportant) https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html No treated as vulnerability: https://sourceware.org/glibc/wiki/Security%20Exceptions Affected range <=2.41-12+deb13u2 Fixed version Not Fixed EPSS Score 0.394% EPSS Percentile 60th percentile Description The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. glibc (unimportant) eglibc (unimportant) That's standard POSIX behaviour implemented by (e)glibc. Applications using glob need to impose limits for themselves

openldap 2.6.10+dfsg-1 (deb) pkg:deb/debian/openldap@2.6.10%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.021% EPSS Percentile 6th percentile Description OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition. openldap (unimportant) lmdb (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126287) [trixie] - lmdb (Minor issue) [bookworm] - lmdb (Minor issue) [bullseye] - lmdb (Minor issue, OOB read) https://seclists.org/fulldisclosure/2026/Jan/5 https://bugs.openldap.org/show_bug.cgi?id=10421 Fixed by: https://git.openldap.org/openldap/openldap/-/commit/8e1fda85532a3c74276df38a42d234dcdfa1e40d OpenLDAP bundles lmdb but does not build mdb_load.c Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.216% EPSS Percentile 44th percentile Description libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. openldap (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965184) https://bugs.openldap.org/show_bug.cgi?id=9266 https://bugzilla.redhat.com/show_bug.cgi?id=1740070 RedHat/CentOS applied patch: https://git.centos.org/rpms/openldap/raw/67459960064be9d226d57c5f82aaba0929876813/f/SOURCES/openldap-tlso-dont-check-cn-when-bad-san.patch OpenLDAP upstream did dispute the issue as beeing valid, as the current libldap behaviour does conform with RFC4513. RFC6125 does not superseed the rules for verifying service identity provided in specifications for existing application protocols published prior to RFC6125, like RFC4513 for LDAP. Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 6.194% EPSS Percentile 91st percentile Description contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. openldap (unimportant) http://www.openldap.org/its/index.cgi/Incoming?id=8759 nops slapd-module not built Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 0.092% EPSS Percentile 26th percentile Description slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript. openldap (unimportant) http://www.openldap.org/its/index.cgi?findid=8703 Negligible security impact, but filed #877512 Affected range <=2.6.10+dfsg-1 Fixed version Not Fixed EPSS Score 1.912% EPSS Percentile 83rd percentile Description The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors. openldap (unimportant) Debian builds with GNUTLS, not NSS

systemd 257.9-1~deb13u1 (deb) pkg:deb/debian/systemd@257.9-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13 Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.117% EPSS Percentile 31st percentile Description An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.125% EPSS Percentile 32nd percentile Description An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.160% EPSS Percentile 37th percentile Description An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." systemd (unimportant) Disputed by upstream https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Affected range <=257.9-1~deb13u1 Fixed version Not Fixed EPSS Score 0.042% EPSS Percentile 13th percentile Description systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. systemd (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357) [wheezy] - systemd (/etc/tmpfiles.d not supported in Wheezy) https://bugzilla.redhat.com/show_bug.cgi?id=859060 only relevant to systems running systemd along with selinux

curl 8.14.1-2+deb13u2 (deb) pkg:deb/debian/curl@8.14.1-2%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.084% EPSS Percentile 24th percentile Description When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. curl 8.18.0-1 (unimportant) https://curl.se/docs/CVE-2025-15224.html Introduced with: curl/curl@c92d2e1 (curl-7_58_0) Fixed by: curl/curl@16d5f2a (curl-8_18_0) Debian builds with libssh2 for SSH backend Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.035% EPSS Percentile 10th percentile Description When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. curl 8.18.0~rc3-1 (unimportant) https://curl.se/docs/CVE-2025-15079.html Introduced with: curl/curl@c92d2e1 (curl-7_58_0) Fixed by: curl/curl@adca486 (rc-8_18_0-3, curl-8_18_0) Debian builds with libssh2 for SSH backend Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.007% EPSS Percentile 1st percentile Description When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. curl 8.18.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2025-14017.html Introduced with: curl/curl@ccba0d1 (curl-7_17_0) Fixed by: curl/curl@39d1976 (rc-8_18_0-1, curl-8_18_0) Built with OpenLDAP (only affects the legacy LDAP support) Affected range <=8.14.1-2+deb13u2 Fixed version Not Fixed EPSS Score 0.020% EPSS Percentile 5th percentile Description curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more. curl 8.17.0~rc2-1 (unimportant) https://curl.se/docs/CVE-2025-10966.html Introduced with: curl/curl@6773c7c (curl-7_69_0) Fixed by: curl/curl@b011e3f (rc-8_17_0-1) wolfSSH backend not used in Debian

sqlite3 3.46.1-7 (deb) pkg:deb/debian/sqlite3@3.46.1-7?os_distro=trixie&os_name=debian&os_version=13 Affected range <3.46.1-7+deb13u1 Fixed version 3.46.1-7+deb13u1 EPSS Score 0.057% EPSS Percentile 18th percentile Description An integer overflow exists in the FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds. sqlite3 3.46.1-8 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114609) [trixie] - sqlite3 3.46.1-7+deb13u1 [bookworm] - sqlite3 (Minor issue) [bullseye] - sqlite3 (The vulnerable code was introduced later) GHSA-v2c8-vqqp-hv3g Fixed by: https://sqlite.org/src/info/63595b74956a9391 Fixed by: sqlite/sqlite@192d0ff Affected range <=3.46.1-7+deb13u1 Fixed version Not Fixed EPSS Score 0.038% EPSS Percentile 11th percentile Description An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. sqlite3 (unimportant) https://sqlite.org/src/info/3d459f1fb1bd1b5e https://sqlite.org/forum/forumpost/761eac3c82 https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 zipfile extension not build for Debian binary package builds Affected range <=3.46.1-7+deb13u1 Fixed version Not Fixed EPSS Score 0.271% EPSS Percentile 50th percentile Description A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect. sqlite3 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005974) sqlite (unimportant) https://github.com/guyinatuxedo/sqlite3_record_leaking https://bugzilla.redhat.com/show_bug.cgi?id=2054793 https://sqlite.org/forum/forumpost/056d557c2f8c452ed5bb9c215414c802b215ce437be82be047726e521342161e Negligible security impact

krb5 1.21.3-5 (deb) pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 0.081% EPSS Percentile 24th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. krb5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant) https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md Fixed by: krb5/krb5@c5f9c81 Codepath cannot be triggered via API calls, negligible security impact https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 0.250% EPSS Percentile 48th percentile Description Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. krb5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098754; unimportant) https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md Fixed by: krb5/krb5@c5f9c81 Unused codepath, negligible security impact https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html Affected range <=1.21.3-5 Fixed version Not Fixed EPSS Score 1.485% EPSS Percentile 81st percentile Description An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data. krb5 (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889684) https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow non-issue, codepath is only run on trusted input, potential integer overflow is non-issue

util-linux 2.41-5 (deb) pkg:deb/debian/util-linux@2.41-5?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.41-5 Fixed version Not Fixed EPSS Score 0.007% EPSS Percentile 0th percentile Description A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database. util-linux 2.41.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122058; unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2419369 util-linux setpwnam.c 256-byte login off-by-one util-linux/util-linux#3585 Fix heap-buffer-overread in setpwnam.c triggered by 256-byte username util-linux/util-linux#3586 Fixed by: util-linux/util-linux@aaa9e71 Fixed by: util-linux/util-linux@9a36d77 Affected code in setpwnam() is only used by chsh and chfn which are not build in any Debian released binary package from src:util-linux and explicitly configured as with --disable-chfn-chsh since 2.25-1. Affected range <=2.41-5 Fixed version Not Fixed EPSS Score 0.025% EPSS Percentile 7th percentile Description A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. util-linux (unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2053151 https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u util-linux/util-linux@faa5a3a util-linux in Debian does build with readline support but chfn and chsh are provided by src:shadow and util-linux is configured with --disable-chfn-chsh

coreutils 9.7-3 (deb) pkg:deb/debian/coreutils@9.7-3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=9.7-3 Fixed version Not Fixed EPSS Score 0.130% EPSS Percentile 32nd percentile Description A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. coreutils (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106733; unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2368764 https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00036.html https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00040.html https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633 https://www.openwall.com/lists/oss-security/2025/05/27/2 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507 Crash in CLI tool, no security impact Affected range <=9.7-3 Fixed version Not Fixed EPSS Score 0.056% EPSS Percentile 17th percentile Description In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition. coreutils (unimportant) http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html https://www.openwall.com/lists/oss-security/2018/01/04/3 Documentation patches proposed: https://lists.gnu.org/archive/html/coreutils/2017-12/msg00072.html https://lists.gnu.org/archive/html/coreutils/2017-12/msg00073.html Neutralised by kernel hardening

bash-completion 1:2.16.0-7 (deb) pkg:deb/debian/bash-completion@1%3A2.16.0-7?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1:2.16.0-7 Fixed version Not Fixed EPSS Score 0.070% EPSS Percentile 21st percentile Description In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. bash-completion (unimportant) util-linux 2.31.1-0.5 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892179) [jessie] - util-linux (umount completion added later) [wheezy] - util-linux (umount completion added later) Fix in bash-completion's from util-linux: util-linux/util-linux@75f03ba#diff-a47601b5dbce9dc06c3af1deb02758c7 src:util-linux/2.28-1 takes over the umount completion from src:bash-completion (which in turn starting from 1:2.1-4.3 does not provide the umount completion in the binary packaage)

apt 3.0.3 (deb) pkg:deb/debian/apt@3.0.3?os_distro=trixie&os_name=debian&os_version=13 Affected range <=3.0.3 Fixed version Not Fixed EPSS Score 1.509% EPSS Percentile 81st percentile Description It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. apt (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480) Not exploitable in Debian, since no keyring URI is defined

pygments 2.19.2 (pypi) pkg:pypi/pygments@2.19.2 Inefficient Regular Expression Complexity Affected range <2.20.0 Fixed version 2.20.0 CVSS Score 1.9 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P EPSS Score 0.014% EPSS Percentile 3rd percentile Description A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

pip 25.3 (pypi) pkg:pypi/pip@25.3 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <26.0 Fixed version 26.0 CVSS Score 2 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N EPSS Score 0.022% EPSS Percentile 6th percentile Description When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

gnutls28 3.8.9-3+deb13u2 (deb) pkg:deb/debian/gnutls28@3.8.9-3%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=3.8.9-3+deb13u2 Fixed version Not Fixed EPSS Score 3.832% EPSS Percentile 88th percentile Description The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. sun-java6 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645881) [lenny] - sun-java6 (Non-free not supported) [squeeze] - sun-java6 (Non-free not supported) openjdk-6 6b23~pre11-1 openjdk-7 7~b147-2.0-1 iceweasel (Vulnerable code not present) http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/ chromium-browser 15.0.874.106~r107270-1 [squeeze] - chromium-browser lighttpd 1.4.30-1 strictly speaking this is no lighttpd issue, but lighttpd adds a workaround curl 7.24.0-1 http://curl.haxx.se/docs/adv_20120124B.html python2.6 2.6.8-0.1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684511) [squeeze] - python2.6 (Minor issue) python2.7 2.7.3~rc1-1 python3.1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678998) [squeeze] - python3.1 (Minor issue) python3.2 3.2.3~rc1-1 http://bugs.python.org/issue13885 python3.1 is fixed starting 3.1.5 cyassl gnutls26 (unimportant) gnutls28 (unimportant) No mitigation for gnutls, it is recommended to use TLS 1.1 or 1.2 which is supported since 2.0.0 haskell-tls (unimportant) No mitigation for haskell-tls, it is recommended to use TLS 1.1, which is supported since 0.2 matrixssl (low) [squeeze] - matrixssl (Minor issue) [wheezy] - matrixssl (Minor issue) matrixssl fix this upstream in 3.2.2 bouncycastle 1.49+dfsg-1 [squeeze] - bouncycastle (Minor issue) [wheezy] - bouncycastle (Minor issue) No mitigation for bouncycastle, it is recommended to use TLS 1.1, which is supported since 1.4.9 nss 3.13.1.with.ckbi.1.88-1 https://bugzilla.mozilla.org/show_bug.cgi?id=665814 https://hg.mozilla.org/projects/nss/rev/7f7446fcc7ab polarssl (unimportant) No mitigation for polarssl, it is recommended to use TLS 1.1, which is supported in all releases tlslite [wheezy] - tlslite (Minor issue) pound 2.6-2 Pound 2.6-2 added an anti_beast.patch to mitigate BEAST attacks. erlang 1:15.b-dfsg-1 [squeeze] - erlang (Minor issue) asterisk 1:13.7.2dfsg-1 [jessie] - asterisk 1:11.13.1dfsg-2+deb8u1 [wheezy] - asterisk (Minor issue) [squeeze] - asterisk (Not supported in Squeeze LTS) http://downloads.digium.com/pub/security/AST-2016-001.html https://issues.asterisk.org/jira/browse/ASTERISK-24972 patch for 11 (jessie): https://code.asterisk.org/code/changelog/asterisk?cs=f233bcd81d85626ce5bdd27b05bc95d131faf3e4 all versions vulnerable, backport required for wheezy

shadow 1:4.17.4-2 (deb) pkg:deb/debian/shadow@1%3A4.17.4-2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=1:4.17.4-2 Fixed version Not Fixed EPSS Score 0.196% EPSS Percentile 42nd percentile Description initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers. shadow (unimportant) See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so unknown usernames are not recorded on login failures

perl 5.40.1-6 (deb) pkg:deb/debian/perl@5.40.1-6?os_distro=trixie&os_name=debian&os_version=13 Affected range <=5.40.1-6 Fixed version Not Fixed EPSS Score 0.181% EPSS Percentile 40th percentile Description _is_safe in the File::Temp module for Perl does not properly handle symlinks. perl (unimportant; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776268) http://thread.gmane.org/gmane.comp.security.oss.general/6174/focus=6177 File:Temp::_is_safe() allows unsafe traversal of symlinks [rt.cpan.org #69106] Perl-Toolchain-Gang/File-Temp#14

jansson 2.14-2 (deb) pkg:deb/debian/jansson@2.14-2?os_distro=trixie&os_name=debian&os_version=13 Affected range <=2.14-2 Fixed version Not Fixed EPSS Score 0.659% EPSS Percentile 71st percentile Description An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification jansson (unimportant) OOB Read memory corruption bug akheron/jansson#548 Disputed security impact (only if programmer fails to follow API specifications)

dpkg 1.22.21 (deb) pkg:deb/debian/dpkg@1.22.21?os_distro=trixie&os_name=debian&os_version=13 Affected range <1.22.22 Fixed version 1.22.22 EPSS Score 0.021% EPSS Percentile 6th percentile Description It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU). dpkg 1.23.6 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129722) [trixie] - dpkg 1.22.22 [bookworm] - dpkg (Minor issue; can be fixed in point release) [bullseye] - dpkg (Vulnerable code introduced later) Introduced with: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=2c2f7066bd8c3209762762fa6905fa567b08ca5a (1.21.18) Fixed by: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313 (1.23.6)

unzip 6.0-29 (deb) pkg:deb/debian/unzip@6.0-29?os_distro=trixie&os_name=debian&os_version=13 Affected range <=6.0-29 Fixed version Not Fixed EPSS Score 0.195% EPSS Percentile 41st percentile Description A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. unzip (unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2044583 https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077 Crash in CLI tool, no security impact

[github-actions]

Recommended fixes for image vecoli:latest

Base image is debian:13-slim

Name	13.3-slim
Digest	sha256:ef514b33e858a6ddd5a2af2b50f08f7ff2e43726a14d5f53bdb1d75220dfa5fb
Vulnerabilities
Pushed	2 months ago
Size	30 MB
Packages	111
OS	13.3

The base image is also available under the supported tag(s): trixie-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

Tag	Details	Pushed	Vulnerabilities
13-slim Newer image for same tag Also known as: 13.4-slim trixie-slim trixie-20260406-slim	Benefits: Same OS detected Newer image for same tag Minor OS version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 17 Image contains equal number of packages Tag is using slim variant Image details: Size: 30 MB OS: 13.4	2 days ago

Change base image

Tag	Details	Pushed	Vulnerabilities
stable-slim Tag is preferred tag Also known as: stable-20260406-slim	Benefits: Same OS detected Tag is preferred tag Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 17 Image contains equal number of packages Tag is using slim variant stable-slim was pulled 46K times last month Image details: Size: 30 MB Flavor: debian OS: 12 Slim: ✅	2 days ago
13 Tag is latest Also known as: 13.4 latest trixie trixie-20260406	Benefits: Same OS detected Minor OS version update Tag was pushed more recently Tag is latest Image introduces no new vulnerability but removes 17 Image contains equal number of packages Image details: Size: 49 MB OS: 13.4	2 days ago

[rjuenemann]

Thank you for setting this up!

[prismofeverything]

Looks like a good change, thanks Sean!