Releases: HomeLabHD/hubzilla
Releases · HomeLabHD/hubzilla
Release list
latest-dev
📦 hubzilla — v0.0.0-dev+8f9871e
Release type: prerelease • Commit:
8f9871e
Security: 🛡️ ❌ Critical — 22 critical and 348 high vulnerabilities detected
Image Availability
| Registry | Image | Tags |
|---|---|---|
| Docker Hub | docker.io/hlhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
| cr.pcfae.com | cr.pcfae.com/hlhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
| GitHub Container Registry | ghcr.io/homelabhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
Digest pull commands & supply chain artifacts
docker.io/hlhd/hubzilla
docker pull docker.io/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
cr.pcfae.com/hlhd/hubzilla
docker pull cr.pcfae.com/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
ghcr.io/homelabhd/hubzilla
docker pull ghcr.io/homelabhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
Notable Changes
Breaking Changes
- image: link bundled addons into the path hubzilla scans, so pubcrawl and the rest load (SoFMeRight)
- image: serve hubzilla from the image so its routing contract ships with the code (SoFMeRight)
Features
- image: build hubzilla at a pinned revision from our own mirrors (SoFMeRight)
Bug Fixes
- image: drop an msmtp flag that was passed a value, which failed every send at option parsing (SoFMeRight)
- image: give the image a mail transport and restore libzip (SoFMeRight)
Documentation
- refresh generated badges (stagefreight) ×5
- drop the decorative emoji from the title (SoFMeRight)
- describe the image serving http on 8080 and its proxy requirements (SoFMeRight)
- add readme, upstream license and configuration reference (SoFMeRight)
Maintenance
- governance reconcile from gitlab.prplanit.com/PrPlanIT/MaintenancePolicy (StageFreight) ×2
Security
🛡️ ❌ Critical — 22 critical and 348 high vulnerabilities detected
Vulnerability details (22 critical, 348 high, 1632 medium, 949 low)
| Severity | CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|---|
| Critical | CVE-2023-6879 | libaom3 | 3.6.0-1+deb12u3 | — | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
| Critical | CVE-2026-58016 | libglib2.0-0 | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2026-58016 | libglib2.0-data | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2023-5841 | libopenexr-3-1-30 | 3.1.5-5 | — | Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is... |
| Critical | CVE-2026-42216 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-42217 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-13221 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | libperl5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2025-7458 | libsqlite3-0 | 3.40.1-2+deb12u2 | — | An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of... |
| Critical | CVE-2026-6653 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | — | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper... |
| Critical | CVE-2026-43185 | linux-libc-dev | 6.1.180-1 | — | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| Critical | CVE-2026-13221 | perl | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2026-13221 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl-base | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2026-13221 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2023-45853 | zlib1g | 1:1.2.13.dfsg-1 | — | zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 |
| High | CVE-2026-53613 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| High | CVE-2026-76642 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing... |
| High | CVE-2026-78408 | bsdutils | 1:2.38.1-5+deb12u3 | — | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve()... |
| High | CVE-2026-78409 | bsdutils | 1:2.38.1-5+deb12u3 | — | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW... |
| High | CVE-2026-78410 | bsdutils | 1:2.38.1-5+deb12u3 | — | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount... |
| High | CVE-2026-12064 | curl | 7.88.1-10+deb12u15 | — | When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl... |
| High | CVE-2026-6276 | curl | 7.88.1-10+deb12u15 | — | Using libcurl, when a custom Host: header is first set for an HTTP request an... |
dev-8f9871e
📦 hubzilla — v0.0.0-dev+8f9871e
Release type: prerelease • Commit:
8f9871e
Security: 🛡️ ❌ Critical — 22 critical and 348 high vulnerabilities detected
Image Availability
| Registry | Image | Tags |
|---|---|---|
| Docker Hub | docker.io/hlhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
| cr.pcfae.com | cr.pcfae.com/hlhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
| GitHub Container Registry | ghcr.io/homelabhd/hubzilla |
dev-8f9871e latest-dev latest-v11-dev |
Digest pull commands & supply chain artifacts
docker.io/hlhd/hubzilla
docker pull docker.io/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
cr.pcfae.com/hlhd/hubzilla
docker pull cr.pcfae.com/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
ghcr.io/homelabhd/hubzilla
docker pull ghcr.io/homelabhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
Notable Changes
Breaking Changes
- image: link bundled addons into the path hubzilla scans, so pubcrawl and the rest load (SoFMeRight)
- image: serve hubzilla from the image so its routing contract ships with the code (SoFMeRight)
Features
- image: build hubzilla at a pinned revision from our own mirrors (SoFMeRight)
Bug Fixes
- image: drop an msmtp flag that was passed a value, which failed every send at option parsing (SoFMeRight)
- image: give the image a mail transport and restore libzip (SoFMeRight)
Documentation
- refresh generated badges (stagefreight) ×5
- drop the decorative emoji from the title (SoFMeRight)
- describe the image serving http on 8080 and its proxy requirements (SoFMeRight)
- add readme, upstream license and configuration reference (SoFMeRight)
Maintenance
- governance reconcile from gitlab.prplanit.com/PrPlanIT/MaintenancePolicy (StageFreight) ×2
Security
🛡️ ❌ Critical — 22 critical and 348 high vulnerabilities detected
Vulnerability details (22 critical, 348 high, 1632 medium, 949 low)
| Severity | CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|---|
| Critical | CVE-2023-6879 | libaom3 | 3.6.0-1+deb12u3 | — | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
| Critical | CVE-2026-58016 | libglib2.0-0 | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2026-58016 | libglib2.0-data | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2023-5841 | libopenexr-3-1-30 | 3.1.5-5 | — | Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is... |
| Critical | CVE-2026-42216 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-42217 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-13221 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | libperl5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2025-7458 | libsqlite3-0 | 3.40.1-2+deb12u2 | — | An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of... |
| Critical | CVE-2026-6653 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | — | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper... |
| Critical | CVE-2026-43185 | linux-libc-dev | 6.1.180-1 | — | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| Critical | CVE-2026-13221 | perl | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2026-13221 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl-base | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2026-13221 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string... |
| Critical | CVE-2026-42496 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit... |
| Critical | CVE-2023-45853 | zlib1g | 1:1.2.13.dfsg-1 | — | zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 |
| High | CVE-2026-53613 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| High | CVE-2026-76642 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing... |
| High | CVE-2026-78408 | bsdutils | 1:2.38.1-5+deb12u3 | — | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve()... |
| High | CVE-2026-78409 | bsdutils | 1:2.38.1-5+deb12u3 | — | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW... |
| High | CVE-2026-78410 | bsdutils | 1:2.38.1-5+deb12u3 | — | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount... |
| High | CVE-2026-12064 | curl | 7.88.1-10+deb12u15 | — | When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl... |
| High | CVE-2026-6276 | curl | 7.88.1-10+deb12u15 | — | Using libcurl, when a custom Host: header is first set for an HTTP request an... |
dev-4f7ff7a
📦 hubzilla — v0.0.0-dev+4f7ff7a
Release type: prerelease • Commit:
4f7ff7a
Security: 🛡️ ❌ Critical — 22 critical and 335 high vulnerabilities detected
Image Availability
| Registry | Image | Tags |
|---|---|---|
| Docker Hub | docker.io/hlhd/hubzilla |
dev-4f7ff7a latest-dev latest-v11-dev |
| cr.pcfae.com | cr.pcfae.com/hlhd/hubzilla |
dev-4f7ff7a latest-dev latest-v11-dev |
| GitHub Container Registry | ghcr.io/homelabhd/hubzilla |
dev-4f7ff7a latest-dev latest-v11-dev |
Digest pull commands & supply chain artifacts
docker.io/hlhd/hubzilla
docker pull docker.io/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
cr.pcfae.com/hlhd/hubzilla
docker pull cr.pcfae.com/hlhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
ghcr.io/homelabhd/hubzilla
docker pull ghcr.io/homelabhd/hubzilla@sha256:c99c341064598119a4509873ecea2b9f6a9e9f5e3bfcac9c14484d01d24c9fde
Notable Changes
Breaking Changes
- image: link bundled addons into the path hubzilla scans, so pubcrawl and the rest load (SoFMeRight)
- image: serve hubzilla from the image so its routing contract ships with the code (SoFMeRight)
Features
- image: build hubzilla at a pinned revision from our own mirrors (SoFMeRight)
Bug Fixes
- image: drop an msmtp flag that was passed a value, which failed every send at option parsing (SoFMeRight)
- image: give the image a mail transport and restore libzip (SoFMeRight)
Documentation
- drop the decorative emoji from the title (SoFMeRight)
- refresh generated badges (stagefreight) ×4
- describe the image serving http on 8080 and its proxy requirements (SoFMeRight)
- add readme, upstream license and configuration reference (SoFMeRight)
Maintenance
- governance reconcile from gitlab.prplanit.com/PrPlanIT/MaintenancePolicy (StageFreight)
Security
🛡️ ❌ Critical — 22 critical and 335 high vulnerabilities detected
Vulnerability details (22 critical, 335 high, 1610 medium, 973 low)
| Severity | CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|---|
| Critical | CVE-2023-6879 | libaom3 | 3.6.0-1+deb12u3 | — | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
| Critical | CVE-2026-58016 | libglib2.0-0 | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2026-58016 | libglib2.0-data | 2.74.6-2+deb12u9 | — | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with... |
| Critical | CVE-2023-5841 | libopenexr-3-1-30 | 3.1.5-5 | — | Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is... |
| Critical | CVE-2026-42216 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-42217 | libopenexr-3-1-30 | 3.1.5-5 | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry... |
| Critical | CVE-2026-13221 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When... |
| Critical | CVE-2026-42496 | libperl5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | libperl5.36 | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of... |
| Critical | CVE-2025-7458 | libsqlite3-0 | 3.40.1-2+deb12u2 | — | An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of... |
| Critical | CVE-2026-6653 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | — | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper... |
| Critical | CVE-2026-43185 | linux-libc-dev | 6.1.180-1 | — | kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() |
| Critical | CVE-2026-13221 | perl | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When... |
| Critical | CVE-2026-42496 | perl | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of... |
| Critical | CVE-2026-13221 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When... |
| Critical | CVE-2026-42496 | perl-base | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-base | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of... |
| Critical | CVE-2026-13221 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When... |
| Critical | CVE-2026-42496 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink()... |
| Critical | CVE-2026-8376 | perl-modules-5.36 | 5.36.0-7+deb12u3 | — | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of... |
| Critical | CVE-2023-45853 | zlib1g | 1:1.2.13.dfsg-1 | — | zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 |
| High | CVE-2026-53613 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path |
| High | CVE-2026-76642 | bsdutils | 1:2.38.1-5+deb12u3 | — | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing... |
| High | CVE-2026-78408 | bsdutils | 1:2.38.1-5+deb12u3 | — | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve()... |
| High | CVE-2026-78409 | bsdutils | 1:2.38.1-5+deb12u3 | — | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW... |
| High | CVE-2026-78410 | bsdutils | 1:2.38.1-5+deb12u3 | — | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount... |
| High | CVE-2026-12064 | curl | 7.88.1-10+deb12u15 | — | When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl... |
| High | CVE-2026-6276 | curl | 7.88.1-10+deb12u15 | — | Using libcurl, when a custom Host: header is first set for an HTTP reque... |