{"grype_matches":[{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-12","epss":0.04697,"percentile":0.91926}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-47917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-47917","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-11-12","epss":0.02443,"percentile":0.84554}],"risk":1.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-47917"},"relatedVulnerabilities":[{"id":"CVE-2025-47917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H","metrics":{"baseScore":8.9,"impactScore":6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-11-12","epss":0.02443,"percentile":0.84554}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47917","description":"Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-12","epss":0.01572,"percentile":0.75758}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-12","epss":0.01545,"percentile":0.75355}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"e60e38fa4cfa24a6","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.9?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.9","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119586"},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-12","epss":0.01179,"percentile":0.68119}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-11-12","epss":0.0182,"percentile":0.79056}],"risk":0.546,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-11-12","epss":0.0182,"percentile":0.79056}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"7d2099105b228ac2","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"fixed","versions":["3.13.10","3.14.1","3.15.0a2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a2"},{"date":"2026-06-18","kind":"first-observed","version":"3.13.10"},{"date":"2026-06-18","kind":"first-observed","version":"3.14.1"},{"date":"2026-06-18","kind":"first-observed","version":"3.15.0a2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.46386000000000005,"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-12","epss":0.0148,"percentile":0.74285}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-12","epss":0.0148,"percentile":0.74285}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-12","epss":0.0148,"percentile":0.74285}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-12","epss":0.0148,"percentile":0.74285}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-12","epss":0.00829,"percentile":0.57992}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-12","epss":0.00829,"percentile":0.57992}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-12","epss":0.00829,"percentile":0.57992}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-12","epss":0.00829,"percentile":0.57992}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-11-12","epss":0.0077,"percentile":0.56104}],"risk":0.385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57052"},"relatedVulnerabilities":[{"id":"CVE-2025-57052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-11-12","epss":0.0077,"percentile":0.56104}],"urls":["https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability","https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-12","epss":0.00727,"percentile":0.54648}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-12","epss":0.0071,"percentile":0.54018}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-12","epss":0.00702,"percentile":0.53745}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67215","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-11-12","epss":0.007,"percentile":0.53649}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67215"},"relatedVulnerabilities":[{"id":"CVE-2026-67215","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-11-12","epss":0.007,"percentile":0.53649}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-12","epss":0.00689,"percentile":0.53239}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-12","epss":0.00681,"percentile":0.52915}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-12","epss":0.00674,"percentile":0.5263}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-12","epss":0.00674,"percentile":0.5263}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-12","epss":0.00674,"percentile":0.5263}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-12","epss":0.00674,"percentile":0.5263}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"9c02489cc4237990","cpes":["cpe:2.3:a:libx264-164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264-164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*"],"name":"libx264-164","purl":"pkg:deb/ubuntu/libx264-164@2%3A0.164.3108%2Bgit31e19f9-1?arch=amd64&distro=ubuntu-24.04&upstream=x264","type":"deb","version":"2:0.164.3108+git31e19f9-1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","ISC","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx264-164/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libx264-164/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"x264"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x264","version":"2:0.164.3108+git31e19f9-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-12","epss":0.00672,"percentile":0.52582}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-12","epss":0.00671,"percentile":0.52533}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31755","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31755","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-11-12","epss":0.00648,"percentile":0.51584}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31755"},"relatedVulnerabilities":[{"id":"CVE-2024-31755","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-11-12","epss":0.00648,"percentile":0.51584}],"urls":["https://github.com/DaveGamble/cJSON/issues/839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31755","description":"cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-12","epss":0.00648,"percentile":0.51562}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-12","epss":0.00648,"percentile":0.51562}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-12","epss":0.00648,"percentile":0.51562}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-12","epss":0.00648,"percentile":0.51562}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-12","epss":0.00647,"percentile":0.51526}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-12","epss":0.00646,"percentile":0.51475}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67216","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-11-12","epss":0.00645,"percentile":0.51453}],"risk":0.3225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67216"},"relatedVulnerabilities":[{"id":"CVE-2026-67216","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-11-12","epss":0.00645,"percentile":0.51453}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-12","epss":0.0062,"percentile":0.50244}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-12","epss":0.0062,"percentile":0.50244}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-12","epss":0.0062,"percentile":0.50244}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-12","epss":0.0062,"percentile":0.50244}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-12","epss":0.00619,"percentile":0.50168}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-12","epss":0.00615,"percentile":0.49972}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-12","epss":0.00615,"percentile":0.49972}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-12","epss":0.00615,"percentile":0.49972}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-12","epss":0.00615,"percentile":0.49972}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-12","epss":0.00599,"percentile":0.49186}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-12","epss":0.00588,"percentile":0.48618}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-12","epss":0.00588,"percentile":0.48618}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-11-12","epss":0.00586,"percentile":0.48522}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-11-12","epss":0.00586,"percentile":0.48522}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-11-12","epss":0.00583,"percentile":0.48328}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-11-12","epss":0.00583,"percentile":0.48328}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-12","epss":0.0058,"percentile":0.48205}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-12","epss":0.00578,"percentile":0.48114}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-48965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-11-12","epss":0.00574,"percentile":0.4791}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48965"},"relatedVulnerabilities":[{"id":"CVE-2025-48965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-11-12","epss":0.00574,"percentile":0.4791}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48965","description":"Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"8bc1c8460275f7b9","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@68.1.2-2ubuntu1.2?arch=all&distro=ubuntu-24.04&upstream=setuptools","type":"deb","version":"68.1.2-2ubuntu1.2","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-59890","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"setuptools","version":"68.1.2-2ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-59890","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59890","cwe":"CWE-697","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59890","date":"2026-11-12","epss":0.0053,"percentile":0.45331}],"risk":0.265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-59890"},"relatedVulnerabilities":[{"id":"CVE-2026-59890","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59890","cwe":"CWE-697","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59890","date":"2026-11-12","epss":0.0053,"percentile":0.45331}],"urls":["https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/setuptools/releases/tag/v83.0.0","https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87933","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-11-12","epss":0.00527,"percentile":0.45149}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87933"},"relatedVulnerabilities":[{"id":"CVE-2026-87933","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-11-12","epss":0.00527,"percentile":0.45149}],"urls":["https://github.com/DaveGamble/cJSON/","https://github.com/DaveGamble/cJSON/issues/1060","https://github.com/DaveGamble/cJSON/pull/1065","https://vuldb.com/cve/CVE-2026-87933","https://vuldb.com/submit/911136","https://vuldb.com/vuln/401815","https://vuldb.com/vuln/401815/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87933","description":"A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-12","epss":0.00524,"percentile":0.44938}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-12","epss":0.00506,"percentile":0.43733}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-12","epss":0.00496,"percentile":0.43089}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-12","epss":0.00496,"percentile":0.43045}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-1000520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-11-12","epss":0.00786,"percentile":0.5662}],"risk":0.23580000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000520"},"relatedVulnerabilities":[{"id":"CVE-2018-1000520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-11-12","epss":0.00786,"percentile":0.5662}],"urls":["https://github.com/ARMmbed/mbedtls/issues/1561"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000520","description":"ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted.."}]},{"artifact":{"id":"7d2099105b228ac2","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"fixed","versions":["3.13.15","3.14.7","3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.7"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-08-12","kind":"first-observed","version":"3.13.15"},{"date":"2026-08-12","kind":"first-observed","version":"3.14.7"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"risk":0.234895,"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-12","epss":0.00467,"percentile":0.40896}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-12","epss":0.0046,"percentile":0.40361}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-12","epss":0.0046,"percentile":0.40358}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-12","epss":0.0046,"percentile":0.40357}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-12","epss":0.0046,"percentile":0.40297}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-12","epss":0.00458,"percentile":0.40161}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-12","epss":0.00454,"percentile":0.39885}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-12","epss":0.00454,"percentile":0.39857}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"85460752c3000dd1","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.39-0exp1ubuntu0.24.04.3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.39-0exp1ubuntu0.24.04.3?arch=amd64&distro=ubuntu-24.04&upstream=libxslt","type":"deb","version":"1.1.39-0exp1ubuntu0.24.04.3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7425","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxslt","version":"1.1.39-0exp1ubuntu0.24.04.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7425","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-11-12","epss":0.00444,"percentile":0.39086}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7425"},"relatedVulnerabilities":[{"id":"CVE-2025-7425","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-11-12","epss":0.00444,"percentile":0.39086}],"urls":["https://access.redhat.com/errata/RHBA-2025:12345","https://access.redhat.com/errata/RHSA-2025:12447","https://access.redhat.com/errata/RHSA-2025:12450","https://access.redhat.com/errata/RHSA-2025:13267","https://access.redhat.com/errata/RHSA-2025:13308","https://access.redhat.com/errata/RHSA-2025:13309","https://access.redhat.com/errata/RHSA-2025:13310","https://access.redhat.com/errata/RHSA-2025:13311","https://access.redhat.com/errata/RHSA-2025:13312","https://access.redhat.com/errata/RHSA-2025:13313","https://access.redhat.com/errata/RHSA-2025:13314","https://access.redhat.com/errata/RHSA-2025:13335","https://access.redhat.com/errata/RHSA-2025:13464","https://access.redhat.com/errata/RHSA-2025:13622","https://access.redhat.com/errata/RHSA-2025:14059","https://access.redhat.com/errata/RHSA-2025:14396","https://access.redhat.com/errata/RHSA-2025:14818","https://access.redhat.com/errata/RHSA-2025:14819","https://access.redhat.com/errata/RHSA-2025:14853","https://access.redhat.com/errata/RHSA-2025:14858","https://access.redhat.com/errata/RHSA-2025:15308","https://access.redhat.com/errata/RHSA-2025:15672","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:21913","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/errata/RHSA-2026:11503","https://access.redhat.com/security/cve/CVE-2025-7425","https://bugzilla.redhat.com/show_bug.cgi?id=2379274","https://gitlab.gnome.org/GNOME/libxslt/-/issues/140","http://seclists.org/fulldisclosure/2025/Aug/0","http://seclists.org/fulldisclosure/2025/Jul/30","http://seclists.org/fulldisclosure/2025/Jul/32","http://seclists.org/fulldisclosure/2025/Jul/35","http://seclists.org/fulldisclosure/2025/Jul/37","http://www.openwall.com/lists/oss-security/2025/07/11/2","https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7425","description":"A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-29036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-29036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-11-12","epss":0.00444,"percentile":0.39044}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-29036"},"relatedVulnerabilities":[{"id":"CVE-2026-29036","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-11-12","epss":0.00444,"percentile":0.39044}],"urls":["https://github.com/DaveGamble/cJSON","https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29036","description":"cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-12","epss":0.00443,"percentile":0.39008}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34877","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-11-12","epss":0.00442,"percentile":0.38891}],"risk":0.22100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34877"},"relatedVulnerabilities":[{"id":"CVE-2026-34877","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-11-12","epss":0.00442,"percentile":0.38891}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34877","description":"An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-11-12","epss":0.00433,"percentile":0.38035}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67217"},"relatedVulnerabilities":[{"id":"CVE-2026-67217","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-11-12","epss":0.00433,"percentile":0.38035}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-11-12","epss":0.00433,"percentile":0.38022}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-11-12","epss":0.00433,"percentile":0.38022}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-12","epss":0.00431,"percentile":0.37851}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-11-12","epss":0.00424,"percentile":0.37206}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61702"},"relatedVulnerabilities":[{"id":"CVE-2026-61702","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-11-12","epss":0.00424,"percentile":0.37206}],"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-12","epss":0.00422,"percentile":0.37034}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-12","epss":0.00422,"percentile":0.3698}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6d1f2844cc275151","cpes":["cpe:2.3:a:libspeex1:libspeex1:1.2.1-2ubuntu2.24.04.1:*:*:*:*:*:*:*"],"name":"libspeex1","purl":"pkg:deb/ubuntu/libspeex1@1.2.1-2ubuntu2.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=speex","type":"deb","version":"1.2.1-2ubuntu2.24.04.1","language":"","licenses":["BSD-3-Clause","GFDL-1.1-or-later","GFDL-1.2","LGPL-2","LGPL-2.0-or-later","custom-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libspeex1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libspeex1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libspeex1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libspeex1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"speex"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116741","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"speex","version":"1.2.1-2ubuntu2.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116741","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116741","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116741","date":"2026-11-12","epss":0.00418,"percentile":0.36591}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116741"},"relatedVulnerabilities":[{"id":"CVE-2026-116741","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116741","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116741","date":"2026-11-12","epss":0.00418,"percentile":0.36591}],"urls":["https://github.com/xiph/speex","https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177","https://github.com/xiph/speex/issues/42","https://gitlab.xiph.org/xiph/speex/-/merge_requests/32","https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write","https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes","https://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116741","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-12","epss":0.00416,"percentile":0.36382}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-12","epss":0.00415,"percentile":0.36316}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-12","epss":0.00413,"percentile":0.36021}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-12","epss":0.00413,"percentile":0.36021}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"7d2099105b228ac2","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"fixed","versions":["3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"risk":0.20546500000000004,"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-11-12","epss":0.00406,"percentile":0.35325}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34876"},"relatedVulnerabilities":[{"id":"CVE-2026-34876","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-11-12","epss":0.00406,"percentile":0.35325}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34876","description":"An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API."}]},{"artifact":{"id":"0bf934ad0e4dae4b","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/ubuntu/libgdk-pixbuf-2.0-0@2.42.10%2Bdfsg-3ubuntu3.3?arch=amd64&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-12","epss":0.00405,"percentile":0.35295}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-12","epss":0.00405,"percentile":0.35295}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"b28b3a9e124727ef","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/ubuntu/libgdk-pixbuf2.0-common@2.42.10%2Bdfsg-3ubuntu3.3?arch=all&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-12","epss":0.00405,"percentile":0.35295}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-12","epss":0.00405,"percentile":0.35295}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-12","epss":0.00401,"percentile":0.34812}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-12","epss":0.00396,"percentile":0.34332}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-12","epss":0.00396,"percentile":0.34263}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-12","epss":0.00395,"percentile":0.34168}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-12","epss":0.00395,"percentile":0.34168}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-12","epss":0.00393,"percentile":0.3399}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-11-12","epss":0.00392,"percentile":0.33828}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87875"},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-11-12","epss":0.00392,"percentile":0.33828}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-12","epss":0.00391,"percentile":0.33666}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-12","epss":0.00384,"percentile":0.32916}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-12","epss":0.00377,"percentile":0.32178}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-12","epss":0.00377,"percentile":0.32138}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"c63c50e09a049480","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"cd1ded1d948407f7","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-12","epss":0.00376,"percentile":0.32022}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-12","epss":0.00374,"percentile":0.31784}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-12","epss":0.00372,"percentile":0.31578}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-12","epss":0.00368,"percentile":0.31061}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16554","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-11-12","epss":0.00367,"percentile":0.30975}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16554"},"relatedVulnerabilities":[{"id":"CVE-2026-16554","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-11-12","epss":0.00367,"percentile":0.30975}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-12","epss":0.00361,"percentile":0.30283}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-12","epss":0.00355,"percentile":0.29618}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-12","epss":0.00355,"percentile":0.29617}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107080","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107080","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-107080","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107080","date":"2026-11-12","epss":0.00352,"percentile":0.29316}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107080"},"relatedVulnerabilities":[{"id":"CVE-2026-107080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107080","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-107080","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107080","date":"2026-11-12","epss":0.00352,"percentile":0.29316}],"urls":["https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33","https://github.com/uclouvain/openjpeg/issues/1673","https://github.com/uclouvain/openjpeg/pull/1674","https://www.openwall.com/lists/oss-security/2026/10/05/5","http://www.openwall.com/lists/oss-security/2026/10/24/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107080","description":"OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-12","epss":0.00352,"percentile":0.29278}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-12","epss":0.0035,"percentile":0.29092}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-12","epss":0.0035,"percentile":0.29056}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-12","epss":0.00348,"percentile":0.28758}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-12","epss":0.00344,"percentile":0.28351}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-12","epss":0.00335,"percentile":0.272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-12","epss":0.00332,"percentile":0.26738}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-12","epss":0.03312,"percentile":0.88735}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-12","epss":0.03312,"percentile":0.88735}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-12","epss":0.03312,"percentile":0.88735}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-12","epss":0.03312,"percentile":0.88735}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52497","cwe":"CWE-193","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-52497","date":"2026-11-12","epss":0.00331,"percentile":0.26654}],"risk":0.1655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52497"},"relatedVulnerabilities":[{"id":"CVE-2025-52497","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52497","cwe":"CWE-193","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-52497","date":"2026-11-12","epss":0.00331,"percentile":0.26654}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-2.md","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52497","description":"Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-12","epss":0.0033,"percentile":0.26544}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-12","epss":0.0033,"percentile":0.26544}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-11-12","epss":0.00328,"percentile":0.26229}],"risk":0.164,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87876"},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-11-12","epss":0.00328,"percentile":0.26229}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25833","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-11-12","epss":0.0032,"percentile":0.25318}],"risk":0.16,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25833"},"relatedVulnerabilities":[{"id":"CVE-2026-25833","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-11-12","epss":0.0032,"percentile":0.25318}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25833","description":"Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-12","epss":0.00319,"percentile":0.25275}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-09-17","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-09-17","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19552","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19552"},"relatedVulnerabilities":[{"id":"CVE-2026-19552","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"urls":["https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e","https://github.com/python/cpython/issues/161503","https://github.com/python/cpython/pull/161507","https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","http://www.openwall.com/lists/oss-security/2026/11/09/25"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19552","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19552"},"relatedVulnerabilities":[{"id":"CVE-2026-19552","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"urls":["https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e","https://github.com/python/cpython/issues/161503","https://github.com/python/cpython/pull/161507","https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","http://www.openwall.com/lists/oss-security/2026/11/09/25"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19552","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19552"},"relatedVulnerabilities":[{"id":"CVE-2026-19552","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"urls":["https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e","https://github.com/python/cpython/issues/161503","https://github.com/python/cpython/pull/161507","https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","http://www.openwall.com/lists/oss-security/2026/11/09/25"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19552","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19552"},"relatedVulnerabilities":[{"id":"CVE-2026-19552","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"urls":["https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e","https://github.com/python/cpython/issues/161503","https://github.com/python/cpython/pull/161507","https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","http://www.openwall.com/lists/oss-security/2026/11/09/25"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-12","epss":0.00307,"percentile":0.23828}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-10-30","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-10-30","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-27810","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-27810","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-27810","cwe":"CWE-908","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-27810","date":"2026-11-12","epss":0.00297,"percentile":0.22621}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27810"},"relatedVulnerabilities":[{"id":"CVE-2025-27810","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27810","cwe":"CWE-908","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-27810","date":"2026-11-12","epss":0.00297,"percentile":0.22621}],"urls":["https://github.com/Mbed-TLS/mbedtls/releases","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27810","description":"Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-12","epss":0.00293,"percentile":0.22214}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34874","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-11-12","epss":0.0029,"percentile":0.21802}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34874"},"relatedVulnerabilities":[{"id":"CVE-2026-34874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-11-12","epss":0.0029,"percentile":0.21802}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34874","description":"An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115559"},"relatedVulnerabilities":[{"id":"CVE-2026-115559","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"urls":["https://github.com/python/cpython/issues/160369","https://github.com/python/cpython/pull/160370","https://mail.python.org/archives/list/security-announce@python.org/thread/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115559","description":"IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115559"},"relatedVulnerabilities":[{"id":"CVE-2026-115559","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"urls":["https://github.com/python/cpython/issues/160369","https://github.com/python/cpython/pull/160370","https://mail.python.org/archives/list/security-announce@python.org/thread/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115559","description":"IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115559"},"relatedVulnerabilities":[{"id":"CVE-2026-115559","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"urls":["https://github.com/python/cpython/issues/160369","https://github.com/python/cpython/pull/160370","https://mail.python.org/archives/list/security-announce@python.org/thread/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115559","description":"IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115559"},"relatedVulnerabilities":[{"id":"CVE-2026-115559","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"urls":["https://github.com/python/cpython/issues/160369","https://github.com/python/cpython/pull/160370","https://mail.python.org/archives/list/security-announce@python.org/thread/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115559","description":"IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25832","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-25832","date":"2026-11-12","epss":0.00282,"percentile":0.20942}],"risk":0.14100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25832"},"relatedVulnerabilities":[{"id":"CVE-2026-25832","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25832","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-25832","date":"2026-11-12","epss":0.00282,"percentile":0.20942}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25832","description":"In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-09-28","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"< 2.39-0ubuntu8.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"fixed","versions":["2.39-0ubuntu8.12"],"available":[{"date":"2026-09-28","kind":"advisory","version":"2.39-0ubuntu8.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66442","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66442","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66442","cwe":"CWE-385","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66442","date":"2026-11-12","epss":0.0028,"percentile":0.20772}],"risk":0.13999999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66442"},"relatedVulnerabilities":[{"id":"CVE-2025-66442","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66442","cwe":"CWE-385","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66442","date":"2026-11-12","epss":0.0028,"percentile":0.20772}],"urls":["https://github.com/Mbed-TLS/TF-PSA-Crypto/releases","https://github.com/Mbed-TLS/mbedtls/releases","https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66442","description":"In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected."}]},{"artifact":{"id":"e60e38fa4cfa24a6","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.9:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.9?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.9","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119379"},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-53154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-53154","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53154","date":"2026-11-12","epss":0.00278,"percentile":0.20501}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-53154"},"relatedVulnerabilities":[{"id":"CVE-2023-53154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53154","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53154","date":"2026-11-12","epss":0.00278,"percentile":0.20501}],"urls":["https://github.com/DaveGamble/cJSON/compare/v1.7.17...v1.7.18","https://github.com/DaveGamble/cJSON/issues/800","https://lists.debian.org/debian-lts-announce/2025/06/msg00014.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53154","description":"parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {\"1\":1, with no trailing newline if cJSON_ParseWithLength is called."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-12","epss":0.00277,"percentile":0.20336}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124249","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124249"},"relatedVulnerabilities":[{"id":"CVE-2026-124249","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"urls":["https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","https://github.com/python/cpython/issues/161569","https://github.com/python/cpython/pull/161570","https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","http://www.openwall.com/lists/oss-security/2026/11/09/24"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124249","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124249"},"relatedVulnerabilities":[{"id":"CVE-2026-124249","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"urls":["https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","https://github.com/python/cpython/issues/161569","https://github.com/python/cpython/pull/161570","https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","http://www.openwall.com/lists/oss-security/2026/11/09/24"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-124249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124249","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124249"},"relatedVulnerabilities":[{"id":"CVE-2026-124249","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"urls":["https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","https://github.com/python/cpython/issues/161569","https://github.com/python/cpython/pull/161570","https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","http://www.openwall.com/lists/oss-security/2026/11/09/24"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124249","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124249"},"relatedVulnerabilities":[{"id":"CVE-2026-124249","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"urls":["https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","https://github.com/python/cpython/issues/161569","https://github.com/python/cpython/pull/161570","https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","http://www.openwall.com/lists/oss-security/2026/11/09/24"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}]},{"artifact":{"id":"c3005cb1b8d81dce","cpes":["cpe:2.3:a:libharfbuzz0b:libharfbuzz0b:8.3.0-2build2:*:*:*:*:*:*:*"],"name":"libharfbuzz0b","purl":"pkg:deb/ubuntu/libharfbuzz0b@8.3.0-2build2?arch=amd64&distro=ubuntu-24.04&upstream=harfbuzz","type":"deb","version":"8.3.0-2build2","language":"","licenses":["Apache-2.0","CC0-1.0","Expat","FSFAP","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","MIT","Monotype","OFL-1.1","UFL-1.0","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libharfbuzz0b/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libharfbuzz0b/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"harfbuzz"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"harfbuzz","version":"8.3.0-2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-22693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-11-12","epss":0.00452,"percentile":0.39726}],"risk":0.13559999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-22693"},"relatedVulnerabilities":[{"id":"CVE-2026-22693","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-11-12","epss":0.00452,"percentile":0.39726}],"urls":["https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae","https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww","http://www.openwall.com/lists/oss-security/2026/01/11/1","http://www.openwall.com/lists/oss-security/2026/01/12/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22693","description":"HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."}]},{"artifact":{"id":"02a955a1796261b8","cpes":["cpe:2.3:a:libtesseract5:libtesseract5:5.3.4-1build5:*:*:*:*:*:*:*"],"name":"libtesseract5","purl":"pkg:deb/ubuntu/libtesseract5@5.3.4-1build5?arch=amd64&distro=ubuntu-24.04&upstream=tesseract","type":"deb","version":"5.3.4-1build5","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtesseract5/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libtesseract5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtesseract5:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libtesseract5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tesseract"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119341","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tesseract","version":"5.3.4-1build5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119341","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-12","epss":0.0027,"percentile":0.19422}],"risk":0.135,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119341"},"relatedVulnerabilities":[{"id":"CVE-2026-119341","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"impactScore":0,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-12","epss":0.0027,"percentile":0.19422}],"urls":["https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23","https://github.com/tesseract-ocr/tesseract/pull/4645","https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119341","description":"Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4."}]},{"artifact":{"id":"6d352b2fd462459b","cpes":["cpe:2.3:a:tesseract-ocr:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract_ocr:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract_ocr:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*"],"name":"tesseract-ocr","purl":"pkg:deb/ubuntu/tesseract-ocr@5.3.4-1build5?arch=amd64&distro=ubuntu-24.04&upstream=tesseract","type":"deb","version":"5.3.4-1build5","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tesseract-ocr/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/tesseract-ocr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tesseract-ocr.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/tesseract-ocr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tesseract-ocr.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/tesseract-ocr.list"}],"upstreams":[{"name":"tesseract"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119341","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tesseract","version":"5.3.4-1build5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119341","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-12","epss":0.0027,"percentile":0.19422}],"risk":0.135,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119341"},"relatedVulnerabilities":[{"id":"CVE-2026-119341","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"impactScore":0,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-12","epss":0.0027,"percentile":0.19422}],"urls":["https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23","https://github.com/tesseract-ocr/tesseract/pull/4645","https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119341","description":"Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4."}]},{"artifact":{"id":"7d2099105b228ac2","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.16.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-116566","versionConstraint":"< 3.16.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.16.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-116566","versionConstraint":"< 3.16.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"fixed","versions":["3.16.0"],"available":[{"date":"2026-11-05","kind":"first-observed","version":"3.16.0"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.133385,"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."},"relatedVulnerabilities":[]},{"artifact":{"id":"d89ef5f93ba22208","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dbc0224a08459408","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"8213e07a58a8ec78","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"16e6be2ba255a19b","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-12","epss":0.00265,"percentile":0.18597}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59438","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-59438","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59438","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-59438","date":"2026-11-12","epss":0.00264,"percentile":0.18391}],"risk":0.132,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59438"},"relatedVulnerabilities":[{"id":"CVE-2025-59438","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59438","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-59438","date":"2026-11-12","epss":0.00264,"percentile":0.18391}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error/","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59438","description":"Mbed TLS through 3.6.4 has an Observable Timing Discrepancy."}]},{"artifact":{"id":"9399a526f720c3e2","cpes":["cpe:2.3:a:libicu74:libicu74:74.2-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"libicu74","purl":"pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu","type":"deb","version":"74.2-1ubuntu3.1","language":"","licenses":["GPL-3","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu74/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libicu74/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu74:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libicu74:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"icu","version":"74.2-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5222","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-11-12","epss":0.00439,"percentile":0.38618}],"risk":0.13169999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5222"},"relatedVulnerabilities":[{"id":"CVE-2025-5222","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-11-12","epss":0.00439,"percentile":0.38618}],"urls":["https://access.redhat.com/errata/RHSA-2025:11888","https://access.redhat.com/errata/RHSA-2025:12083","https://access.redhat.com/errata/RHSA-2025:12331","https://access.redhat.com/errata/RHSA-2025:12332","https://access.redhat.com/errata/RHSA-2025:12333","https://access.redhat.com/errata/RHSA-2026:54544","https://access.redhat.com/errata/RHSA-2026:54553","https://access.redhat.com/errata/RHSA-2026:54581","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/security/cve/CVE-2025-5222","https://bugzilla.redhat.com/show_bug.cgi?id=2368600","https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957","https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5222","description":"A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution."}]},{"artifact":{"id":"995fe9e99f20c9b6","cpes":["cpe:2.3:a:libxrender1:libxrender1:1\\:0.9.10-1.1build1:*:*:*:*:*:*:*"],"name":"libxrender1","purl":"pkg:deb/ubuntu/libxrender1@1%3A0.9.10-1.1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxrender","type":"deb","version":"1:0.9.10-1.1build1","language":"","licenses":["HPND-sell-variant"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxrender1/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libxrender1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxrender"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxrender","version":"1:0.9.10-1.1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-11-12","epss":0.00263,"percentile":0.18305}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88807"},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-11-12","epss":0.00263,"percentile":0.18305}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115819"},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:21210938f5a37a9887b2d0a20428917b923a636ca6efe038c3c7d9cd9f1f9b61","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115819"},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-12","epss":0.00261,"percentile":0.18109}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107655","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107655","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-11-12","epss":0.0026,"percentile":0.17928}],"risk":0.13,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107655"},"relatedVulnerabilities":[{"id":"CVE-2026-107655","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-11-12","epss":0.0026,"percentile":0.17928}],"urls":["https://access.redhat.com/errata/RHSA-2026:80679","https://access.redhat.com/security/cve/CVE-2026-107655","https://bugzilla.redhat.com/show_bug.cgi?id=2548399","https://github.com/OpenPrinting/cups/commit/12237ad","https://github.com/OpenPrinting/cups/commit/25d6830","https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:104d311f0484c03aebb79beea1cc0ae65e346714ce61090a25837acb01d25309","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-12","epss":0.00258,"percentile":0.17642}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T06:47:20.913Z","grype_db_version":"2026-11-13T15:40:34.000Z"}