{"grype_matches":[{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j7hp-h8jx-5ppr","versionConstraint":"<10.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j7hp-h8jx-5ppr","fix":{"state":"fixed","versions":["10.0.1"],"available":[{"date":"2023-10-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4863","date":"2026-10-08","epss":0.99979,"percentile":0.9998}],"risk":85.57500000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-4863","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","https://crbug.com/1479274","https://github.com/qnighy/libwebp-sys2-rs/pull/21","https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b","https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a","https://bugzilla.suse.com/show_bug.cgi?id=1215231","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863","https://news.ycombinator.com/item?id=37478403","https://rustsec.org/advisories/RUSTSEC-2023-0060.html","https://security-tracker.debian.org/tracker/CVE-2023-4863","https://github.com/electron/electron/pull/39823","https://github.com/electron/electron/pull/39825","https://github.com/electron/electron/pull/39826","https://github.com/electron/electron/pull/39827","https://github.com/electron/electron/pull/39828","https://github.com/webmproject/libwebp/releases/tag/v1.3.2","https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html","https://rustsec.org/advisories/RUSTSEC-2023-0061.html","https://security.gentoo.org/glsa/202309-05","https://www.debian.org/security/2023/dsa-5496","https://www.debian.org/security/2023/dsa-5497","https://www.debian.org/security/2023/dsa-5498","http://www.openwall.com/lists/oss-security/2023/09/21/4","http://www.openwall.com/lists/oss-security/2023/09/22/1","http://www.openwall.com/lists/oss-security/2023/09/22/3","http://www.openwall.com/lists/oss-security/2023/09/22/4","http://www.openwall.com/lists/oss-security/2023/09/22/5","http://www.openwall.com/lists/oss-security/2023/09/22/6","http://www.openwall.com/lists/oss-security/2023/09/22/7","http://www.openwall.com/lists/oss-security/2023/09/22/8","http://www.openwall.com/lists/oss-security/2023/09/26/1","http://www.openwall.com/lists/oss-security/2023/09/26/7","http://www.openwall.com/lists/oss-security/2023/09/28/1","http://www.openwall.com/lists/oss-security/2023/09/28/2","http://www.openwall.com/lists/oss-security/2023/09/28/4","https://github.com/jaredforth/webp/pull/30","https://github.com/python-pillow/Pillow/pull/7395","https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc","https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security","https://github.com/ImageMagick/ImageMagick/discussions/6664","https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0","https://security.gentoo.org/glsa/202401-10","https://sethmlarson.dev/security-developer-in-residence-weekly-report-16","https://security.netapp.com/advisory/ntap-20230929-0011","https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863","https://www.bentley.com/advisories/be-2023-0001","https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks","https://www.mozilla.org/en-US/security/advisories/mfsa2023-40","https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863","https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway","https://blog.isosceles.com/the-webp-0day","https://en.bandisoft.com/honeyview/history","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j7hp-h8jx-5ppr","description":"libwebp: OOB write in BuildHuffmanTable","knownExploited":[{"cve":"CVE-2023-4863","cwes":["CWE-787"],"urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1","https://nvd.nist.gov/vuln/detail/CVE-2023-4863"],"dueDate":"2023-10-04","product":"Chromium WebP","dateAdded":"2023-09-13","vendorProject":"Google","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2023-4863","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4863","date":"2026-10-08","epss":0.99979,"percentile":0.9998}],"urls":["http://www.openwall.com/lists/oss-security/2023/09/21/4","http://www.openwall.com/lists/oss-security/2023/09/22/1","http://www.openwall.com/lists/oss-security/2023/09/22/3","http://www.openwall.com/lists/oss-security/2023/09/22/4","http://www.openwall.com/lists/oss-security/2023/09/22/5","http://www.openwall.com/lists/oss-security/2023/09/22/6","http://www.openwall.com/lists/oss-security/2023/09/22/7","http://www.openwall.com/lists/oss-security/2023/09/22/8","http://www.openwall.com/lists/oss-security/2023/09/26/1","http://www.openwall.com/lists/oss-security/2023/09/26/7","http://www.openwall.com/lists/oss-security/2023/09/28/1","http://www.openwall.com/lists/oss-security/2023/09/28/2","http://www.openwall.com/lists/oss-security/2023/09/28/4","https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/","https://blog.isosceles.com/the-webp-0day/","https://bugzilla.suse.com/show_bug.cgi?id=1215231","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","https://crbug.com/1479274","https://en.bandisoft.com/honeyview/history/","https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a","https://github.com/webmproject/libwebp/releases/tag/v1.3.2","https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863","https://news.ycombinator.com/item?id=37478403","https://security-tracker.debian.org/tracker/CVE-2023-4863","https://security.gentoo.org/glsa/202309-05","https://security.gentoo.org/glsa/202401-10","https://security.netapp.com/advisory/ntap-20230929-0011/","https://sethmlarson.dev/security-developer-in-residence-weekly-report-16","https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/","https://www.bentley.com/advisories/be-2023-0001/","https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/","https://www.debian.org/security/2023/dsa-5496","https://www.debian.org/security/2023/dsa-5497","https://www.debian.org/security/2023/dsa-5498","https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/","https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","description":"Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","knownExploited":[{"cve":"CVE-2023-4863","cwes":["CWE-787"],"urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1","https://nvd.nist.gov/vuln/detail/CVE-2023-4863"],"dueDate":"2023-10-04","product":"Chromium WebP","dateAdded":"2023-09-13","vendorProject":"Google","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.11.28"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hmr4-m2h5-33qx","versionConstraint":"<1.11.28 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hmr4-m2h5-33qx","fix":{"state":"fixed","versions":["1.11.28"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.11.28"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7471","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7471","date":"2026-10-08","epss":0.65575,"percentile":0.99249}],"risk":60.82081250000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7471","https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136","https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI","https://www.openwall.com/lists/oss-security/2020/02/03/1","http://www.openwall.com/lists/oss-security/2020/02/03/1","https://seclists.org/bugtraq/2020/Feb/30","https://security.gentoo.org/glsa/202004-17","https://www.debian.org/security/2020/dsa-4629","https://github.com/django/django/commit/001b0634cd309e372edb6d7d95d083d02b8e37bd","https://github.com/django/django/commit/505826b469b16ab36693360da9e11fd13213421b","https://github.com/django/django/commit/c67a368c16e4680b324b4f385398d638db4d8147","https://www.djangoproject.com/weblog/2020/feb/03/security-releases","https://usn.ubuntu.com/4264-1","https://security.netapp.com/advisory/ntap-20200221-0006","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-35.yaml","https://docs.djangoproject.com/en/3.0/releases/security"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hmr4-m2h5-33qx","description":"SQL injection in Django"},"relatedVulnerabilities":[{"id":"CVE-2020-7471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7471","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7471","date":"2026-10-08","epss":0.65575,"percentile":0.99249}],"urls":["http://www.openwall.com/lists/oss-security/2020/02/03/1","https://docs.djangoproject.com/en/3.0/releases/security/","https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136","https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/","https://seclists.org/bugtraq/2020/Feb/30","https://security.gentoo.org/glsa/202004-17","https://security.netapp.com/advisory/ntap-20200221-0006/","https://usn.ubuntu.com/4264-1/","https://www.debian.org/security/2020/dsa-4629","https://www.djangoproject.com/weblog/2020/feb/03/security-releases/","https://www.openwall.com/lists/oss-security/2020/02/03/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7471","description":"Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.11.27"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfq6-hq5r-27r6","versionConstraint":"<1.11.27 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vfq6-hq5r-27r6","fix":{"state":"fixed","versions":["1.11.27"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.11.27"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19844","cwe":"CWE-640","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19844","date":"2026-10-08","epss":0.53561,"percentile":0.98969}],"risk":49.67782750000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-19844","https://github.com/django/django/commit/5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb70","https://github.com/django/django/commit/f4cff43bf921fcea6a29b726eb66767f67753fa2","https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a0","https://seclists.org/bugtraq/2020/Jan/9","https://www.debian.org/security/2020/dsa-4598","http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html","https://security.gentoo.org/glsa/202004-17","https://github.com/django/django/commit/302a4ff1e8b1c798aab97673909c7a3dfda42c26","https://github.com/django/django/commit/4d334bea06cac63dc1272abcec545b85136cca0e","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-16.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD","https://security.netapp.com/advisory/ntap-20200110-0003","https://usn.ubuntu.com/4224-1","https://www.djangoproject.com/weblog/2019/dec/18/security-releases"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfq6-hq5r-27r6","description":"Django Potential account hijack via password reset form"},"relatedVulnerabilities":[{"id":"CVE-2019-19844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19844","cwe":"CWE-640","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19844","date":"2026-10-08","epss":0.53561,"percentile":0.98969}],"urls":["http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html","https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/","https://seclists.org/bugtraq/2020/Jan/9","https://security.gentoo.org/glsa/202004-17","https://security.netapp.com/advisory/ntap-20200110-0003/","https://usn.ubuntu.com/4224-1/","https://www.debian.org/security/2020/dsa-4598","https://www.djangoproject.com/weblog/2019/dec/18/security-releases/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19844","description":"Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)"}]},{"artifact":{"id":"aebc716b731a9dc5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.7","type":"python","version":"2.7","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"39.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4qr-2fvf-3mr5","versionConstraint":">=0.8.1,<39.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.7"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-x4qr-2fvf-3mr5","fix":{"state":"fixed","versions":["39.0.1"],"available":[{"date":"2023-02-09","kind":"first-observed","version":"39.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5","https://nvd.nist.gov/vuln/detail/CVE-2023-0286","https://rustsec.org/advisories/RUSTSEC-2023-0006.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://access.redhat.com/security/cve/cve-2023-0286","https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4qr-2fvf-3mr5","description":"Vulnerable OpenSSL included in cryptography wheels"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"81e3b5866e8f7fce","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.30-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=gnutls28","type":"deb","version":"3.3.30-0+deb8u1","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gnutls28","version":"3.3.30-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"abd911ee4de0543b","cpes":["cpe:2.3:a:libgnutls-openssl27:libgnutls-openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-openssl27:libgnutls_openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls-openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls_openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_openssl27:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libgnutls-openssl27","purl":"pkg:deb/debian/libgnutls-openssl27@3.3.30-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=gnutls28","type":"deb","version":"3.3.30-0+deb8u1","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-openssl27/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgnutls-openssl27/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gnutls28","version":"3.3.30-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"c6dd865fe63b004e","cpes":["cpe:2.3:a:libgnutls28-dev:libgnutls28-dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls28-dev:libgnutls28_dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls28_dev:libgnutls28-dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls28_dev:libgnutls28_dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls28:libgnutls28-dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls28:libgnutls28_dev:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libgnutls28-dev","purl":"pkg:deb/debian/libgnutls28-dev@3.3.30-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=gnutls28","type":"deb","version":"3.3.30-0+deb8u1","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls28-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgnutls28-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls28-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgnutls28-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gnutls28","version":"3.3.30-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"ed06bc970f8ae90f","cpes":["cpe:2.3:a:libgnutlsxx28:libgnutlsxx28:3.3.30-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libgnutlsxx28","purl":"pkg:deb/debian/libgnutlsxx28@3.3.30-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=gnutls28","type":"deb","version":"3.3.30-0+deb8u1","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgnutlsxx28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutlsxx28:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgnutlsxx28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gnutls28","version":"3.3.30-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"risk":34.0695,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.6.13||>= 3.10.0a0, < 3.10.0||>= 3.7.0a0, < 3.7.10||>= 3.8.0a0, < 3.8.8||>= 3.9.0a0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.6.13||>= 3.10.0a0, < 3.10.0||>= 3.7.0a0, < 3.7.10||>= 3.8.0a0, < 3.8.8||>= 3.9.0a0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.8","3.9.2","3.10.0"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.6.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.0"},{"date":"2026-09-22","kind":"first-observed","version":"3.7.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.8.8"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.2"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.0"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.002521666666667,"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-23336","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.8||>= 3.9.0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.8","3.9.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":20.911146666666667,"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-4559","versionConstraint":"< 3.6.16||>= 3.10.0, < 3.10.12||>= 3.11.0, < 3.11.4||>= 3.7.0, < 3.8.17||>= 3.9.0, < 3.9.17 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"fixed","versions":["3.6.16","3.8.17","3.9.17","3.10.12","3.11.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.12"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.17"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-08","epss":0.27095,"percentile":0.98006}],"risk":18.018175000000003,"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."},"relatedVulnerabilities":[]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-frmv-pr5f-9mcr","versionConstraint":"<4.2.26 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-frmv-pr5f-9mcr","fix":{"state":"fixed","versions":["4.2.26"],"available":[{"date":"2025-11-06","kind":"first-observed","version":"4.2.26"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64459","cwe":"CWE-89","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64459","date":"2026-10-08","epss":0.19257,"percentile":0.97275}],"risk":17.427585,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64459","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases","https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85","https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4","https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b","https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241","https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html","https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-frmv-pr5f-9mcr","description":"Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects."},"relatedVulnerabilities":[{"id":"CVE-2025-64459","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64459","cwe":"CWE-89","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64459","date":"2026-10-08","epss":0.19257,"percentile":0.97275}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases/","https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64459","description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-24329","versionConstraint":"< 3.7.17||>= 3.10.0, < 3.10.12||>= 3.11.0, < 3.11.4||>= 3.8.0, < 3.8.17||>= 3.9.0, < 3.9.17 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"fixed","versions":["3.7.17","3.8.17","3.9.17","3.10.12","3.11.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.12"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.17"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"b8ecf169f06de613","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u15?arch=amd64&distro=debian-8.11&upstream=curl","type":"deb","version":"7.38.0-4+deb8u15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.38.0-4+deb8u16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"curl","version":"7.38.0-4+deb8u15"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.38.0-4+deb8u16"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u16"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"risk":13.454250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6w2r-r2m5-xq5w","versionConstraint":"<4.2.24 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-6w2r-r2m5-xq5w","fix":{"state":"fixed","versions":["4.2.24"],"available":[{"date":"2025-09-10","kind":"first-observed","version":"4.2.24"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57833","cwe":"CWE-89","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-57833","date":"2026-10-08","epss":0.16759,"percentile":0.96968}],"risk":12.23407,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-57833","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898","https://www.djangoproject.com/weblog/2025/sep/03/security-releases","https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5","https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92","https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243","https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html","http://www.openwall.com/lists/oss-security/2025/09/03/3","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6w2r-r2m5-xq5w","description":"Django is subject to SQL injection through its column aliases"},"relatedVulnerabilities":[{"id":"CVE-2025-57833","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57833","cwe":"CWE-89","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-57833","date":"2026-10-08","epss":0.16759,"percentile":0.96968}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898","https://www.djangoproject.com/weblog/2025/sep/03/security-releases/","http://www.openwall.com/lists/oss-security/2025/09/03/3","https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias()."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9948","versionConstraint":">= 2.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.185840000000002,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"416e29c1d38cede0","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1058","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"risk":6.549,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1058"},"relatedVulnerabilities":[{"id":"CVE-2018-1058","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"urls":["http://www.securityfocus.com/bid/103221","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=1547044","https://usn.ubuntu.com/3589-1/","https://www.postgresql.org/about/news/1834/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","description":"A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."}]},{"artifact":{"id":"08c55331dd85cf95","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1058","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"risk":6.549,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1058"},"relatedVulnerabilities":[{"id":"CVE-2018-1058","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"urls":["http://www.securityfocus.com/bid/103221","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=1547044","https://usn.ubuntu.com/3589-1/","https://www.postgresql.org/about/news/1834/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","description":"A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."}]},{"artifact":{"id":"414639da26c31e4a","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"558b00f322f756d1","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"7cf79494255d936c","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9636","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.0.0, < 3.4.10||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"fixed","versions":["2.7.17","3.4.10","3.5.7","3.6.9","3.7.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-08","epss":0.07673,"percentile":0.94445}],"risk":6.023305000000001,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.14"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-0391","versionConstraint":"< 3.6.14||>= 3.7.0, < 3.7.11||>= 3.8.0, < 3.8.11||>= 3.9.0, < 3.9.5||= 3.10.0-alpha1||= 3.10.0-alpha2||= 3.10.0-alpha3||= 3.10.0-alpha4||= 3.10.0-alpha5||= 3.10.0-alpha6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"fixed","versions":["3.6.14","3.7.11","3.8.11","3.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.14"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":5.8968750000000005,"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[]},{"artifact":{"id":"ab243b55bd915538","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u3","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13115","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13115","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"risk":5.8295,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13115"},"relatedVulnerabilities":[{"id":"CVE-2019-13115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"urls":["http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow/","https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa","https://github.com/libssh2/libssh2/pull/350","https://libssh2.org/changes.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://security.netapp.com/advisory/ntap-20190806-0002/","https://support.f5.com/csp/article/K13322484","https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h582-2pch-3xv3","versionConstraint":">=1.5,<1.7.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-h582-2pch-3xv3","fix":{"state":"fixed","versions":["1.7.9"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.7.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5143","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5143","date":"2026-10-08","epss":0.07266,"percentile":0.94199}],"risk":5.66748,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5143","https://security.gentoo.org/glsa/201510-06","http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://rhn.redhat.com/errata/RHSA-2015-1678.html","http://rhn.redhat.com/errata/RHSA-2015-1686.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.ubuntu.com/usn/USN-2671-1","https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663","https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9","https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16","https://www.djangoproject.com/weblog/2015/jul/08/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-20.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h582-2pch-3xv3","description":"Django Denial-of-service by filling session store"},"relatedVulnerabilities":[{"id":"CVE-2015-5143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5143","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5143","date":"2026-10-08","epss":0.07266,"percentile":0.94199}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://rhn.redhat.com/errata/RHSA-2015-1678.html","http://rhn.redhat.com/errata/RHSA-2015-1686.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.securityfocus.com/bid/75666","http://www.securitytracker.com/id/1032820","http://www.ubuntu.com/usn/USN-2671-1","https://security.gentoo.org/glsa/201510-06","https://www.djangoproject.com/weblog/2015/jul/08/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5143","description":"The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys."}]},{"artifact":{"id":"63ff9772b7df985c","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"4382f63721b9ab86","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"7cff8d6a1bb86776","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u12?arch=all&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9841","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"risk":5.6625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9841"},"relatedVulnerabilities":[{"id":"CVE-2016-9841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9841","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"risk":5.6625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9841"},"relatedVulnerabilities":[{"id":"CVE-2016-9841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"7b63410c84605e26","cpes":["cpe:2.3:a:python:requests:2.18.4:*:*:*:*:*:*:*"],"name":"requests","purl":"pkg:pypi/requests@2.18.4","type":"python","version":"2.18.4","language":"python","licenses":["Apache 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.20.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x84v-xcm2-53pg","versionConstraint":"<=2.19.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"requests","version":"2.18.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-x84v-xcm2-53pg","fix":{"state":"fixed","versions":["2.20.0"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"2.20.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18074","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18074","date":"2026-10-08","epss":0.07443,"percentile":0.94307}],"risk":5.58225,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-18074","https://github.com/requests/requests/issues/4716","https://github.com/requests/requests/pull/4718","https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff","https://access.redhat.com/errata/RHSA-2019:2035","https://bugs.debian.org/910766","http://docs.python-requests.org/en/master/community/updates/#release-and-version-history","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml","https://usn.ubuntu.com/3790-1","https://usn.ubuntu.com/3790-2"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x84v-xcm2-53pg","description":"Insufficiently Protected Credentials in Requests"},"relatedVulnerabilities":[{"id":"CVE-2018-18074","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18074","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18074","date":"2026-10-08","epss":0.07443,"percentile":0.94307}],"urls":["http://docs.python-requests.org/en/master/community/updates/#release-and-version-history","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html","https://access.redhat.com/errata/RHSA-2019:2035","https://bugs.debian.org/910766","https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff","https://github.com/requests/requests/issues/4716","https://github.com/requests/requests/pull/4718","https://usn.ubuntu.com/3790-1/","https://usn.ubuntu.com/3790-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18074","description":"The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network."}]},{"artifact":{"id":"639cd1fabb3bb50a","cpes":["cpe:2.3:a:kirill_simonov_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:pyyaml:3.11:*:*:*:*:*:*:*"],"name":"pyyaml","purl":"pkg:pypi/pyyaml@3.11","type":"python","version":"3.11","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8q59-q68h-6hv4","versionConstraint":"<5.4 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyyaml","version":"3.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8q59-q68h-6hv4","fix":{"state":"fixed","versions":["5.4"],"available":[{"date":"2021-03-26","kind":"first-observed","version":"5.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14343","date":"2026-10-08","epss":0.05984,"percentile":0.93124}],"risk":5.55016,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-14343","https://github.com/yaml/pyyaml/commit/a001f2782501ad2d24986959f0239a354675f9dc","https://bugzilla.redhat.com/show_bug.cgi?id=1860466","https://github.com/yaml/pyyaml/issues/420#issuecomment-663673966","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/SeldonIO/seldon-core/issues/2252","https://github.com/yaml/pyyaml/issues/420","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2021-142.yaml","https://pypi.org/project/PyYAML"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8q59-q68h-6hv4","description":"Improper Input Validation in PyYAML"},"relatedVulnerabilities":[{"id":"CVE-2020-14343","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14343","date":"2026-10-08","epss":0.05984,"percentile":0.93124}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1860466","https://github.com/SeldonIO/seldon-core/issues/2252","https://github.com/yaml/pyyaml/issues/420","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14343","description":"A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747."}]},{"artifact":{"id":"639cd1fabb3bb50a","cpes":["cpe:2.3:a:kirill_simonov_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:pyyaml:3.11:*:*:*:*:*:*:*"],"name":"pyyaml","purl":"pkg:pypi/pyyaml@3.11","type":"python","version":"3.11","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rprw-h62v-c2w7","versionConstraint":"<5.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyyaml","version":"3.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-rprw-h62v-c2w7","fix":{"state":"fixed","versions":["5.1"],"available":[{"date":"2026-07-02","kind":"first-observed","version":"5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18342","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18342","date":"2026-10-08","epss":0.05656,"percentile":0.92774}],"risk":5.3166400000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-18342","https://github.com/marshmallow-code/apispec/issues/278","https://github.com/yaml/pyyaml/issues/193","https://github.com/yaml/pyyaml/pull/74","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation","https://security.gentoo.org/glsa/202003-45","https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA","https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rprw-h62v-c2w7","description":"PyYAML insecurely deserializes YAML strings leading to arbitrary code execution"},"relatedVulnerabilities":[{"id":"CVE-2017-18342","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18342","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18342","date":"2026-10-08","epss":0.05656,"percentile":0.92774}],"urls":["https://github.com/marshmallow-code/apispec/issues/278","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://github.com/yaml/pyyaml/issues/193","https://github.com/yaml/pyyaml/pull/74","https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/","https://security.gentoo.org/glsa/202003-45"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18342","description":"In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"risk":5.279249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4448"},"relatedVulnerabilities":[{"id":"CVE-2016-4448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.openwall.com/lists/oss-security/2016/05/25/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/90856","http://www.securitytracker.com/id/1036348","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722","http://xmlsoft.org/news.html","https://access.redhat.com/errata/RHSA-2016:1292","https://bugzilla.redhat.com/show_bug.cgi?id=1338700","https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9","https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709","https://kc.mcafee.com/corporate/index?page=content&id=SB10170","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905","https://www.tenable.com/security/tns-2016-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4448","description":"Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"risk":5.279249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4448"},"relatedVulnerabilities":[{"id":"CVE-2016-4448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.openwall.com/lists/oss-security/2016/05/25/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/90856","http://www.securitytracker.com/id/1036348","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722","http://xmlsoft.org/news.html","https://access.redhat.com/errata/RHSA-2016:1292","https://bugzilla.redhat.com/show_bug.cgi?id=1338700","https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9","https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709","https://kc.mcafee.com/corporate/index?page=content&id=SB10170","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905","https://www.tenable.com/security/tns-2016-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4448","description":"Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"risk":5.0235,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"risk":5.0235,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"63ff9772b7df985c","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"4382f63721b9ab86","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"7cff8d6a1bb86776","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u12?arch=all&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.7||>= 3.9.0, < 3.9.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.7","3.9.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-15903","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.10||>= 3.7.0, < 3.7.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.10","3.7.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"risk":4.594741666666667,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."},"relatedVulnerabilities":[]},{"artifact":{"id":"416e29c1d38cede0","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9193","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9193","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"risk":4.58275,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9193"},"relatedVulnerabilities":[{"id":"CVE-2019-9193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"urls":["http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html","http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html","http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html","https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/","https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5","https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/","https://security.netapp.com/advisory/ntap-20190502-0003/","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9193","description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’."}]},{"artifact":{"id":"08c55331dd85cf95","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9193","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9193","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"risk":4.58275,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9193"},"relatedVulnerabilities":[{"id":"CVE-2019-9193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"urls":["http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html","http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html","http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html","https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/","https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5","https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/","https://security.netapp.com/advisory/ntap-20190502-0003/","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9193","description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-10160","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4||= 3.8.0-alpha4||= 3.8.0-beta1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.495220000000001,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crhm-qpjc-cm64","versionConstraint":"<1.8.15 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-crhm-qpjc-cm64","fix":{"state":"fixed","versions":["1.8.15"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7401","cwe":"CWE-254","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7401","date":"2026-10-08","epss":0.05702,"percentile":0.92815}],"risk":4.44756,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-7401","http://rhn.redhat.com/errata/RHSA-2016-2038.html","http://rhn.redhat.com/errata/RHSA-2016-2039.html","http://rhn.redhat.com/errata/RHSA-2016-2040.html","http://rhn.redhat.com/errata/RHSA-2016-2041.html","http://rhn.redhat.com/errata/RHSA-2016-2042.html","http://rhn.redhat.com/errata/RHSA-2016-2043.html","http://www.debian.org/security/2016/dsa-3678","http://www.ubuntu.com/usn/USN-3089-1","https://web.archive.org/web/20200227223637/http://www.securityfocus.com/bid/93182","https://web.archive.org/web/20210927195154/http://www.securitytracker.com/id/1036899","https://github.com/django/django/commit/6fe846a8f08dc959003f298b5407e321c6fe3735","https://github.com/django/django/commit/6118ab7d0676f0d622278e5be215f14fb5410b6a","https://github.com/django/django/commit/d1bc980db1c0fffd6d60677e62f70beadb9fe64a","https://www.djangoproject.com/weblog/2016/sep/26/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-3.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crhm-qpjc-cm64","description":"Django CSRF Protection Bypass"},"relatedVulnerabilities":[{"id":"CVE-2016-7401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7401","cwe":"CWE-254","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7401","date":"2026-10-08","epss":0.05702,"percentile":0.92815}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2038.html","http://rhn.redhat.com/errata/RHSA-2016-2039.html","http://rhn.redhat.com/errata/RHSA-2016-2040.html","http://rhn.redhat.com/errata/RHSA-2016-2041.html","http://rhn.redhat.com/errata/RHSA-2016-2042.html","http://rhn.redhat.com/errata/RHSA-2016-2043.html","http://www.debian.org/security/2016/dsa-3678","http://www.securityfocus.com/bid/93182","http://www.securitytracker.com/id/1036899","http://www.ubuntu.com/usn/USN-3089-1","https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9843","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"risk":4.3245000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9843"},"relatedVulnerabilities":[{"id":"CVE-2016-9843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9843","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"risk":4.3245000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9843"},"relatedVulnerabilities":[{"id":"CVE-2016-9843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."}]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-www2-v7xj-xrc6","versionConstraint":"<1.23 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-www2-v7xj-xrc6","fix":{"state":"fixed","versions":["1.23"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.23"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20060","date":"2026-10-08","epss":0.04488,"percentile":0.91237}],"risk":4.16262,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-20060","https://github.com/urllib3/urllib3/issues/1316","https://github.com/urllib3/urllib3/pull/1346","https://access.redhat.com/errata/RHSA-2019:2272","https://bugzilla.redhat.com/show_bug.cgi?id=1649153","https://github.com/urllib3/urllib3/blob/master/CHANGES.rst","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ","https://usn.ubuntu.com/3990-1","https://security.netapp.com/advisory/ntap-20241227-0010","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-www2-v7xj-xrc6","description":"Exposure of Sensitive Information to an Unauthorized Actor in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2018-20060","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20060","date":"2026-10-08","epss":0.04488,"percentile":0.91237}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","https://access.redhat.com/errata/RHSA-2019:2272","https://bugzilla.redhat.com/show_bug.cgi?id=1649153","https://github.com/urllib3/urllib3/blob/master/CHANGES.rst","https://github.com/urllib3/urllib3/issues/1316","https://github.com/urllib3/urllib3/pull/1346","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/","https://usn.ubuntu.com/3990-1/","https://security.netapp.com/advisory/ntap-20241227-0010/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20060","description":"urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"0edcd4b35209fc0e","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"c9f7a7dc73893658","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19603","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19603","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-08","epss":0.0803,"percentile":0.94645}],"risk":4.015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19603"},"relatedVulnerabilities":[{"id":"CVE-2019-19603","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-08","epss":0.0803,"percentile":0.94645}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://security.netapp.com/advisory/ntap-20191223-0001/","https://usn.ubuntu.com/4394-1/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19603","description":"SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-7595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-7595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"risk":3.918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-7595"},"relatedVulnerabilities":[{"id":"CVE-2020-7595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","description":"xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-7595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-7595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"risk":3.918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-7595"},"relatedVulnerabilities":[{"id":"CVE-2020-7595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","description":"xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7rm-8j6h-r933","versionConstraint":"<=6.2.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-r7rm-8j6h-r933","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2022-06-24","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5311","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5311","date":"2026-10-08","epss":0.04212,"percentile":0.90724}],"risk":3.90663,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5311","https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0580","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-82.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7rm-8j6h-r933","description":"Buffer Copy without Checking Size of Input in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5311","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5311","date":"2026-10-08","epss":0.04212,"percentile":0.90724}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0580","https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5311","description":"libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-8492","versionConstraint":">= 2.7.0, <= 2.7.17||>= 3.5.0, <= 3.5.9||>= 3.6.0, <= 3.6.10||>= 3.7.0, <= 3.7.6||>= 3.8.0, <= 3.8.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.870945,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wvg-mj6g-m9cv","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3wvg-mj6g-m9cv","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27922","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27922","date":"2026-10-08","epss":0.04851,"percentile":0.91799}],"risk":3.7837799999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27922","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-41.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv","description":"Pillow Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27922","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27922","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27922","date":"2026-10-08","epss":0.04851,"percentile":0.91799}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27922","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20506","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-08","epss":0.07565,"percentile":0.94378}],"risk":3.7824999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20506"},"relatedVulnerabilities":[{"id":"CVE-2018-20506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-08","epss":0.07565,"percentile":0.94378}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://seclists.org/fulldisclosure/2019/Jan/62","http://seclists.org/fulldisclosure/2019/Jan/64","http://seclists.org/fulldisclosure/2019/Jan/66","http://seclists.org/fulldisclosure/2019/Jan/67","http://seclists.org/fulldisclosure/2019/Jan/68","http://seclists.org/fulldisclosure/2019/Jan/69","http://www.securityfocus.com/bid/106698","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://seclists.org/bugtraq/2019/Jan/28","https://seclists.org/bugtraq/2019/Jan/29","https://seclists.org/bugtraq/2019/Jan/31","https://seclists.org/bugtraq/2019/Jan/32","https://seclists.org/bugtraq/2019/Jan/33","https://seclists.org/bugtraq/2019/Jan/39","https://security.netapp.com/advisory/ntap-20190502-0004/","https://sqlite.org/src/info/940f2adc8541a838","https://support.apple.com/kb/HT209443","https://support.apple.com/kb/HT209446","https://support.apple.com/kb/HT209447","https://support.apple.com/kb/HT209448","https://support.apple.com/kb/HT209450","https://support.apple.com/kb/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20506","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]},{"artifact":{"id":"6e45ea8380d3353e","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4609","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4609","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"risk":3.75525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4609"},"relatedVulnerabilities":[{"id":"CVE-2016-4609","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4609","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612."}]},{"artifact":{"id":"a70c9c759e956fd7","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4609","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4609","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"risk":3.75525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4609"},"relatedVulnerabilities":[{"id":"CVE-2016-4609","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4609","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612."}]},{"artifact":{"id":"6e45ea8380d3353e","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4610","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4610","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"risk":3.72375,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4610"},"relatedVulnerabilities":[{"id":"CVE-2016-4610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4610","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612."}]},{"artifact":{"id":"a70c9c759e956fd7","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4610","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4610","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"risk":3.72375,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4610"},"relatedVulnerabilities":[{"id":"CVE-2016-4610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4610","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612."}]},{"artifact":{"id":"63ff9772b7df985c","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"4382f63721b9ab86","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"7cff8d6a1bb86776","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u12?arch=all&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"8dcb188b08ab506b","cpes":["cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-py:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-py:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_py:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_py:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:py:python-py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:py:python_py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-py:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_py:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:py:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:py:py:1.8.0:*:*:*:*:*:*:*"],"name":"py","purl":"pkg:pypi/py@1.8.0","type":"python","version":"1.8.0","language":"python","licenses":["MIT license"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.10.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hj5v-574p-mj7c","versionConstraint":"<1.10.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"py","version":"1.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hj5v-574p-mj7c","fix":{"state":"fixed","versions":["1.10.0"],"available":[{"date":"2021-04-22","kind":"first-observed","version":"1.10.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29651","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29651","date":"2026-10-08","epss":0.04662,"percentile":0.91512}],"risk":3.6363600000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-29651","https://github.com/pytest-dev/py/issues/256","https://github.com/pytest-dev/py/pull/257","https://github.com/pytest-dev/py/pull/257/commits/4a9017dc6199d2a564b6e4b0aa39d6d8870e4144","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/py/PYSEC-2020-92.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hj5v-574p-mj7c","description":"py vulnerable to Regular Expression Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2020-29651","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29651","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29651","date":"2026-10-08","epss":0.04662,"percentile":0.91512}],"urls":["https://github.com/pytest-dev/py/issues/256","https://github.com/pytest-dev/py/pull/257","https://github.com/pytest-dev/py/pull/257/commits/4a9017dc6199d2a564b6e4b0aa39d6d8870e4144","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR/","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29651","description":"A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"ab5858e8afd43c06","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.42.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=glib2.0","type":"deb","version":"2.42.1-1+deb8u1","language":"","licenses":["sha256:fba5358de01b6b99d385f588714b3b7f64be7074710e4d4152bc3a05dfef1789"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.42.1-1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16428","versionConstraint":"< 2.42.1-1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glib2.0","version":"2.42.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16428","fix":{"state":"fixed","versions":["2.42.1-1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.42.1-1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-08","epss":0.04693,"percentile":0.91558}],"risk":3.51975,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16428"},"relatedVulnerabilities":[{"id":"CVE-2018-16428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-08","epss":0.04693,"percentile":0.91558}],"urls":["http://www.openwall.com/lists/oss-security/2020/02/14/3","http://www.securityfocus.com/bid/105210","https://gitlab.gnome.org/GNOME/glib/commit/fccef3cc822af74699cca84cd202719ae61ca3b9","https://gitlab.gnome.org/GNOME/glib/issues/1364","https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html","https://usn.ubuntu.com/3767-1/","https://usn.ubuntu.com/3767-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16428","description":"In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-16056","versionConstraint":"<= 2.7.16||>= 3.0.0, <= 3.0.1||>= 3.1.0, <= 3.1.5||>= 3.2.0, <= 3.2.6||>= 3.3.0, <= 3.3.7||>= 3.4.0, <= 3.4.10||>= 3.5.0, <= 3.5.7||>= 3.6.0, <= 3.6.9||>= 3.7.0, <= 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.4389333333333334,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p49h-hjvm-jg3h","versionConstraint":"<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-p49h-hjvm-jg3h","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2021-11-04","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5312","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5312","date":"2026-10-08","epss":0.0369,"percentile":0.89409}],"risk":3.4224750000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5312","https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h","description":"PCX P mode buffer overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5312","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5312","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5312","date":"2026-10-08","epss":0.0369,"percentile":0.89409}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312","description":"libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17006","versionConstraint":"< 2:3.26-1+debu8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17006","fix":{"state":"fixed","versions":["2:3.26-1+debu8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u10"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-08","epss":0.03558,"percentile":0.89009}],"risk":3.34452,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17006"},"relatedVulnerabilities":[{"id":"CVE-2019-17006","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-08","epss":0.03558,"percentile":0.89009}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1539788","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes","https://security.netapp.com/advisory/ntap-20210129-0001/","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17006","description":"In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17006","versionConstraint":"< 2:3.26-1+debu8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17006","fix":{"state":"fixed","versions":["2:3.26-1+debu8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u10"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-08","epss":0.03558,"percentile":0.89009}],"risk":3.34452,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17006"},"relatedVulnerabilities":[{"id":"CVE-2019-17006","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-08","epss":0.03558,"percentile":0.89009}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1539788","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes","https://security.netapp.com/advisory/ntap-20210129-0001/","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17006","description":"In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow."}]},{"artifact":{"id":"c25c971ed0bdfe08","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u5:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=expat","type":"deb","version":"2.1.0-6+deb8u5","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15903","versionConstraint":"< 2.1.0-6+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"expat","version":"2.1.0-6+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"fixed","versions":["2.1.0-6+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"risk":3.3215000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15903"},"relatedVulnerabilities":[{"id":"CVE-2019-15903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."}]},{"artifact":{"id":"6e45ea8380d3353e","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13117","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13117","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"risk":3.2285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13117"},"relatedVulnerabilities":[{"id":"CVE-2019-13117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471","https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5631739747106816","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117","description":"In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."}]},{"artifact":{"id":"a70c9c759e956fd7","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13117","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13117","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"risk":3.2285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13117"},"relatedVulnerabilities":[{"id":"CVE-2019-13117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471","https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5631739747106816","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117","description":"In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."}]},{"artifact":{"id":"ab243b55bd915538","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u3","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3859","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3859","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-08","epss":0.06275,"percentile":0.93405}],"risk":3.1375,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3859"},"relatedVulnerabilities":[{"id":"CVE-2019-3859","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-08","epss":0.06275,"percentile":0.93405}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00102.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00103.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3859","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/04/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3859.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3859","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8vj2-vxx3-667w","versionConstraint":"<9.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8vj2-vxx3-667w","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2022-03-12","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22817","date":"2026-10-08","epss":0.03334,"percentile":0.88299}],"risk":3.0922850000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22817","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://www.debian.org/security/2022/dsa-5053","https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8vj2-vxx3-667w","description":"Arbitrary expression injection in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-22817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22817","date":"2026-10-08","epss":0.03334,"percentile":0.88299}],"urls":["https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10","https://www.debian.org/security/2022/dsa-5053"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817","description":"PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-3217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-08","epss":0.06169,"percentile":0.93305}],"risk":3.0845000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-3217"},"relatedVulnerabilities":[{"id":"CVE-2015-3217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-08","epss":0.06169,"percentile":0.93305}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-1025.html","http://rhn.redhat.com/errata/RHSA-2016-2750.html","http://vcs.pcre.org/pcre?view=revision&revision=1566","http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886","http://www.openwall.com/lists/oss-security/2015/06/03/7","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/75018","https://access.redhat.com/errata/RHSA-2016:1132","https://bugs.exim.org/show_bug.cgi?id=1638","https://bugzilla.redhat.com/show_bug.cgi?id=1228283"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3217","description":"PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c8c8-9472-w52h","versionConstraint":"<1.8.14 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-c8c8-9472-w52h","fix":{"state":"fixed","versions":["1.8.14"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6186","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6186","date":"2026-10-08","epss":0.05581,"percentile":0.9268}],"risk":2.9858349999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-6186","https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158","https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d","http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html","http://rhn.redhat.com/errata/RHSA-2016-1594.html","http://rhn.redhat.com/errata/RHSA-2016-1595.html","http://rhn.redhat.com/errata/RHSA-2016-1596.html","http://seclists.org/fulldisclosure/2016/Jul/53","http://www.debian.org/security/2016/dsa-3622","http://www.ubuntu.com/usn/USN-3039-1","http://www.vulnerability-lab.com/get_content.php?id=1869","https://web.archive.org/web/20201022155237/http://www.securityfocus.com/archive/1/538947/100/0/threaded","https://web.archive.org/web/20210123154652/http://www.securityfocus.com/bid/92058","https://web.archive.org/web/20211204042848/http://www.securitytracker.com/id/1036338","https://github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW","https://www.djangoproject.com/weblog/2016/jul/18/security-releases","https://www.exploit-db.com/exploits/40129","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c8c8-9472-w52h","description":"Django Cross-site scripting Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2016-6186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6186","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6186","date":"2026-10-08","epss":0.05581,"percentile":0.9268}],"urls":["http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html","http://rhn.redhat.com/errata/RHSA-2016-1594.html","http://rhn.redhat.com/errata/RHSA-2016-1595.html","http://rhn.redhat.com/errata/RHSA-2016-1596.html","http://seclists.org/fulldisclosure/2016/Jul/53","http://www.debian.org/security/2016/dsa-3622","http://www.securityfocus.com/archive/1/538947/100/0/threaded","http://www.securityfocus.com/bid/92058","http://www.securitytracker.com/id/1036338","http://www.ubuntu.com/usn/USN-3039-1","http://www.vulnerability-lab.com/get_content.php?id=1869","https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158","https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW/","https://www.djangoproject.com/weblog/2016/jul/18/security-releases/","https://www.exploit-db.com/exploits/40129/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6186","description":"Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML."}]},{"artifact":{"id":"63ff9772b7df985c","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"4382f63721b9ab86","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u12?arch=amd64&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"7cff8d6a1bb86776","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u12:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u12?arch=all&distro=debian-8.11&upstream=perl","type":"deb","version":"5.20.2-3+deb8u12","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"perl","version":"5.20.2-3+deb8u12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-16932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"risk":2.964,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16932"},"relatedVulnerabilities":[{"id":"CVE-2017-16932","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"urls":["http://xmlsoft.org/news.html","https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","https://bugzilla.gnome.org/show_bug.cgi?id=759579","https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://usn.ubuntu.com/3739-1/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","description":"parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"risk":2.964,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16932"},"relatedVulnerabilities":[{"id":"CVE-2017-16932","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"urls":["http://xmlsoft.org/news.html","https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","https://bugzilla.gnome.org/show_bug.cgi?id=759579","https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://usn.ubuntu.com/3739-1/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","description":"parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7534-mm45-c74v","versionConstraint":"<8.3.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-7534-mm45-c74v","fix":{"state":"fixed","versions":["8.3.0"],"available":[{"date":"2021-10-06","kind":"first-observed","version":"8.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34552","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34552","date":"2026-10-08","epss":0.03188,"percentile":0.87701}],"risk":2.95687,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-34552","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://github.com/python-pillow/Pillow/pull/5567","https://security.gentoo.org/glsa/202211-10","https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7534-mm45-c74v","description":"Buffer Overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-34552","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34552","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34552","date":"2026-10-08","epss":0.03188,"percentile":0.87701}],"urls":["https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://security.gentoo.org/glsa/202211-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552","description":"Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c."}]},{"artifact":{"id":"ee6d043f846d818a","cpes":["cpe:2.3:a:celeryproject:celery:3.1.18:*:*:*:*:python:*:*"],"name":"celery","purl":"pkg:pypi/celery@3.1.18","type":"python","version":"3.1.18","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xr-rc97-m4xx","versionConstraint":"<5.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"celery","version":"3.1.18"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q4xr-rc97-m4xx","fix":{"state":"fixed","versions":["5.2.2"],"available":[{"date":"2022-01-07","kind":"first-observed","version":"5.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23727","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23727","date":"2026-10-08","epss":0.03877,"percentile":0.89941}],"risk":2.927135,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23727","https://github.com/celery/celery/blob/master/Changelog.rst%23522","https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953","https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b","https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xr-rc97-m4xx","description":"OS Command Injection in celery"},"relatedVulnerabilities":[{"id":"CVE-2021-23727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23727","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23727","date":"2026-10-08","epss":0.03877,"percentile":0.89941}],"urls":["https://github.com/celery/celery/blob/master/Changelog.rst%23522","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/","https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23727","description":"This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6323","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6323","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6323","date":"2026-10-08","epss":0.05834,"percentile":0.92979}],"risk":2.9170000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6323"},"relatedVulnerabilities":[{"id":"CVE-2018-6323","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6323","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6323","date":"2026-10-08","epss":0.05834,"percentile":0.92979}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/102821","https://sourceware.org/bugzilla/show_bug.cgi?id=22746","https://www.exploit-db.com/exploits/44035/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6323","description":"The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9740","versionConstraint":">= 2.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":2.875253333333333,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5qw-4364-5hhm","versionConstraint":">=1.5,<1.7.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q5qw-4364-5hhm","fix":{"state":"fixed","versions":["1.7.9"],"available":[{"date":"2023-08-05","kind":"first-observed","version":"1.7.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5144","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5144","date":"2026-10-08","epss":0.03665,"percentile":0.89342}],"risk":2.8587000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5144","https://security.gentoo.org/glsa/201510-06","http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.ubuntu.com/usn/USN-2671-1","https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a","https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0","https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649","https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54","https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820","https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665","https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c","https://www.djangoproject.com/weblog/2015/jul/08/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5qw-4364-5hhm","description":"Django Vulnerable to HTTP Response Splitting Attack"},"relatedVulnerabilities":[{"id":"CVE-2015-5144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5144","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5144","date":"2026-10-08","epss":0.03665,"percentile":0.89342}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.securityfocus.com/bid/75665","http://www.securitytracker.com/id/1032820","http://www.ubuntu.com/usn/USN-2671-1","https://security.gentoo.org/glsa/201510-06","https://www.djangoproject.com/weblog/2015/jul/08/security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5144","description":"Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-19956","versionConstraint":"< 2.9.1+dfsg1-5+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19956","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"risk":2.78,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19956"},"relatedVulnerabilities":[{"id":"CVE-2019-19956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549","https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.netapp.com/advisory/ntap-20200114-0002/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","description":"xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19956","versionConstraint":"< 2.9.1+dfsg1-5+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19956","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"risk":2.78,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19956"},"relatedVulnerabilities":[{"id":"CVE-2019-19956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549","https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.netapp.com/advisory/ntap-20200114-0002/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","description":"xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-17522","versionConstraint":"<= 3.6.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-17522","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17522","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17522","date":"2026-10-08","epss":0.03595,"percentile":0.89136}],"risk":2.750175,"urls":["http://www.securityfocus.com/bid/102207","https://bugs.python.org/issue32367","https://security-tracker.debian.org/tracker/CVE-2017-17522"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17522","description":"Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting"},"relatedVulnerabilities":[]},{"artifact":{"id":"3dc7a0363d8f956c","cpes":["cpe:2.3:a:httplib2_project:httplib2:0.13.0:*:*:*:*:python:*:*","cpe:2.3:a:httplib2_project:httplib2:0.13.0:*:*:*:*:*:*:*"],"name":"httplib2","purl":"pkg:pypi/httplib2@0.13.0","type":"python","version":"0.13.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.19.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93xj-8mrv-444m","versionConstraint":"<0.19.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"httplib2","version":"0.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-93xj-8mrv-444m","fix":{"state":"fixed","versions":["0.19.0"],"available":[{"date":"2021-02-09","kind":"first-observed","version":"0.19.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21240","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2021-21240","date":"2026-10-08","epss":0.03626,"percentile":0.89225}],"risk":2.73763,"urls":["https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","https://github.com/httplib2/httplib2/pull/182","https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc","https://nvd.nist.gov/vuln/detail/CVE-2021-21240","https://pypi.org/project/httplib2","https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2021-16.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93xj-8mrv-444m","description":"Regular Expression Denial of Service (REDoS) in httplib2"},"relatedVulnerabilities":[{"id":"CVE-2021-21240","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21240","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2021-21240","date":"2026-10-08","epss":0.03626,"percentile":0.89225}],"urls":["https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc","https://github.com/httplib2/httplib2/pull/182","https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","https://pypi.org/project/httplib2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9947","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.69654,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9842","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9842"},"relatedVulnerabilities":[{"id":"CVE-2016-9842","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9842","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9842"},"relatedVulnerabilities":[{"id":"CVE-2016-9842","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."}]},{"artifact":{"id":"6e45ea8380d3353e","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13118","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13118","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"risk":2.5945,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13118"},"relatedVulnerabilities":[{"id":"CVE-2019-13118","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://seclists.org/fulldisclosure/2019/Aug/11","http://seclists.org/fulldisclosure/2019/Aug/13","http://seclists.org/fulldisclosure/2019/Aug/14","http://seclists.org/fulldisclosure/2019/Aug/15","http://seclists.org/fulldisclosure/2019/Jul/22","http://seclists.org/fulldisclosure/2019/Jul/23","http://seclists.org/fulldisclosure/2019/Jul/24","http://seclists.org/fulldisclosure/2019/Jul/26","http://seclists.org/fulldisclosure/2019/Jul/31","http://seclists.org/fulldisclosure/2019/Jul/37","http://seclists.org/fulldisclosure/2019/Jul/38","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069","https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5197371471822848","https://seclists.org/bugtraq/2019/Aug/21","https://seclists.org/bugtraq/2019/Aug/22","https://seclists.org/bugtraq/2019/Aug/23","https://seclists.org/bugtraq/2019/Aug/25","https://seclists.org/bugtraq/2019/Jul/35","https://seclists.org/bugtraq/2019/Jul/36","https://seclists.org/bugtraq/2019/Jul/37","https://seclists.org/bugtraq/2019/Jul/40","https://seclists.org/bugtraq/2019/Jul/41","https://seclists.org/bugtraq/2019/Jul/42","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://support.apple.com/kb/HT210346","https://support.apple.com/kb/HT210348","https://support.apple.com/kb/HT210351","https://support.apple.com/kb/HT210353","https://support.apple.com/kb/HT210356","https://support.apple.com/kb/HT210357","https://support.apple.com/kb/HT210358","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118","description":"In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data."}]},{"artifact":{"id":"a70c9c759e956fd7","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13118","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13118","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"risk":2.5945,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13118"},"relatedVulnerabilities":[{"id":"CVE-2019-13118","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://seclists.org/fulldisclosure/2019/Aug/11","http://seclists.org/fulldisclosure/2019/Aug/13","http://seclists.org/fulldisclosure/2019/Aug/14","http://seclists.org/fulldisclosure/2019/Aug/15","http://seclists.org/fulldisclosure/2019/Jul/22","http://seclists.org/fulldisclosure/2019/Jul/23","http://seclists.org/fulldisclosure/2019/Jul/24","http://seclists.org/fulldisclosure/2019/Jul/26","http://seclists.org/fulldisclosure/2019/Jul/31","http://seclists.org/fulldisclosure/2019/Jul/37","http://seclists.org/fulldisclosure/2019/Jul/38","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069","https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5197371471822848","https://seclists.org/bugtraq/2019/Aug/21","https://seclists.org/bugtraq/2019/Aug/22","https://seclists.org/bugtraq/2019/Aug/23","https://seclists.org/bugtraq/2019/Aug/25","https://seclists.org/bugtraq/2019/Jul/35","https://seclists.org/bugtraq/2019/Jul/36","https://seclists.org/bugtraq/2019/Jul/37","https://seclists.org/bugtraq/2019/Jul/40","https://seclists.org/bugtraq/2019/Jul/41","https://seclists.org/bugtraq/2019/Jul/42","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://support.apple.com/kb/HT210346","https://support.apple.com/kb/HT210348","https://support.apple.com/kb/HT210351","https://support.apple.com/kb/HT210353","https://support.apple.com/kb/HT210356","https://support.apple.com/kb/HT210357","https://support.apple.com/kb/HT210358","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118","description":"In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"ab243b55bd915538","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u3","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3860","versionConstraint":"< 1.4.3-4.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3860","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"risk":2.559,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3860"},"relatedVulnerabilities":[{"id":"CVE-2019-3860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3860.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3860","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9746","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9746","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9746","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"risk":2.5518,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9746"},"relatedVulnerabilities":[{"id":"CVE-2017-9746","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9746","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9746","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"urls":["http://www.securityfocus.com/bid/99117","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21580","https://www.exploit-db.com/exploits/42199/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9746","description":"The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9749","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9749","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9749","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9749","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"risk":2.5518,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9749"},"relatedVulnerabilities":[{"id":"CVE-2017-9749","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9749","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9749","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"urls":["http://www.securityfocus.com/bid/99113","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21586","https://www.exploit-db.com/exploits/42201/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9749","description":"The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-08","epss":0.05033,"percentile":0.92053}],"risk":2.5165,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7186"},"relatedVulnerabilities":[{"id":"CVE-2017-7186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-08","epss":0.05033,"percentile":0.92053}],"urls":["http://www.securityfocus.com/bid/97030","https://access.redhat.com/errata/RHSA-2018:2486","https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/","https://bugs.exim.org/show_bug.cgi?id=2052","https://security.gentoo.org/glsa/201710-09","https://security.gentoo.org/glsa/201710-25","https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date","https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7186","description":"libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup."}]},{"artifact":{"id":"219d2718cef52c0e","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13565","versionConstraint":"< 2.4.40+dfsg-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13565","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-08","epss":0.05015,"percentile":0.92033}],"risk":2.5075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13565"},"relatedVulnerabilities":[{"id":"CVE-2019-13565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-08","epss":0.05015,"percentile":0.92033}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://seclists.org/fulldisclosure/2019/Dec/26","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","https://seclists.org/bugtraq/2019/Dec/23","https://support.apple.com/kb/HT210788","https://support.f5.com/csp/article/K98008862?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4078-1/","https://usn.ubuntu.com/4078-2/","https://www.openldap.org/its/index.cgi/?findid=9052","https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user."}]},{"artifact":{"id":"5bb209255b1ff2bc","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/debian/libtasn1-6@4.2-3%2Bdeb8u3?arch=amd64&distro=debian-8.11","type":"deb","version":"4.2-3+deb8u3","language":"","licenses":["sha256:7faa7a2e10c1267fe75183ec4f0d556d78d9630f29e1a7e704d1f6d67041216f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2-3+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-10790","versionConstraint":"< 4.2-3+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libtasn1-6","version":"4.2-3+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10790","fix":{"state":"fixed","versions":["4.2-3+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.2-3+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"risk":2.495,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10790"},"relatedVulnerabilities":[{"id":"CVE-2017-10790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464141","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00026.html","https://security.gentoo.org/glsa/201710-11","https://usn.ubuntu.com/3547-1/","https://www.debian.org/security/2018/dsa-4106"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10790","description":"The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack."}]},{"artifact":{"id":"1811866f4c990401","cpes":["cpe:2.3:a:libtasn1-6-dev:libtasn1-6-dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6-dev:libtasn1_6_dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6_dev:libtasn1-6-dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6_dev:libtasn1_6_dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1-6-dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6_dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6-dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6_dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6-dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6_dev:4.2-3\\+deb8u3:*:*:*:*:*:*:*"],"name":"libtasn1-6-dev","purl":"pkg:deb/debian/libtasn1-6-dev@4.2-3%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=libtasn1-6","type":"deb","version":"4.2-3+deb8u3","language":"","licenses":["sha256:7faa7a2e10c1267fe75183ec4f0d556d78d9630f29e1a7e704d1f6d67041216f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libtasn1-6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libtasn1-6-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libtasn1-6-dev.list"}],"upstreams":[{"name":"libtasn1-6"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2-3+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10790","versionConstraint":"< 4.2-3+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libtasn1-6","version":"4.2-3+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10790","fix":{"state":"fixed","versions":["4.2-3+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.2-3+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"risk":2.495,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10790"},"relatedVulnerabilities":[{"id":"CVE-2017-10790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464141","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00026.html","https://security.gentoo.org/glsa/201710-11","https://usn.ubuntu.com/3547-1/","https://www.debian.org/security/2018/dsa-4106"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10790","description":"The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f4w8-cv6p-x6r5","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-f4w8-cv6p-x6r5","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27921","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27921","date":"2026-10-08","epss":0.0317,"percentile":0.87643}],"risk":2.4726000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27921","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-40.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5","description":"Pillow Denial of Service by Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27921","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27921","date":"2026-10-08","epss":0.0317,"percentile":0.87643}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27921","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-16935","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.0.0, < 3.5.8||>= 3.6.0, < 3.6.10||>= 3.7.0, < 3.7.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.10","3.7.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":2.442825,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j7mj-748x-7p78","versionConstraint":"<6.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j7mj-748x-7p78","fix":{"state":"fixed","versions":["6.2.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16865","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16865","date":"2026-10-08","epss":0.03128,"percentile":0.87478}],"risk":2.4398400000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16865","https://github.com/python-pillow/Pillow/issues/4123","https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://www.debian.org/security/2020/dsa-4631","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3","https://ubuntu.com/security/notices/USN-4272-1","https://usn.ubuntu.com/4272-1","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j7mj-748x-7p78","description":"DOS attack in Pillow when processing specially crafted image files"},"relatedVulnerabilities":[{"id":"CVE-2019-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16865","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16865","date":"2026-10-08","epss":0.03128,"percentile":0.87478}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image."}]},{"artifact":{"id":"2cf3bff59245719d","cpes":["cpe:2.3:a:sqlparse_project:sqlparse:0.1.19:*:*:*:*:python:*:*"],"name":"sqlparse","purl":"pkg:pypi/sqlparse@0.1.19","type":"python","version":"0.1.19","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2m57-hf25-phgg","versionConstraint":"<0.5.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"sqlparse","version":"0.1.19"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-2m57-hf25-phgg","fix":{"state":"fixed","versions":["0.5.0"],"available":[{"date":"2024-04-16","kind":"first-observed","version":"0.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4340","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-4340","date":"2026-10-08","epss":0.03237,"percentile":0.87912}],"risk":2.42775,"urls":["https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg","https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03","https://nvd.nist.gov/vuln/detail/CVE-2024-4340","https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2m57-hf25-phgg","description":"sqlparse parsing heavily nested list leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2024-4340","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4340","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-4340","date":"2026-10-08","epss":0.03237,"percentile":0.87912}],"urls":["https://github.com/advisories/GHSA-2m57-hf25-phgg","https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03","https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/","https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4340","description":"Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9750","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9750","date":"2026-10-08","epss":0.08075,"percentile":0.94668}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9750"},"relatedVulnerabilities":[{"id":"CVE-2017-9750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9750","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9750","date":"2026-10-08","epss":0.08075,"percentile":0.94668}],"urls":["http://www.securityfocus.com/bid/99118","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21587","https://www.exploit-db.com/exploits/42198/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9750","description":"opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9742","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9742","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9742","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9742","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9742"},"relatedVulnerabilities":[{"id":"CVE-2017-9742","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9742","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9742","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"urls":["http://www.securityfocus.com/bid/99105","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21576","https://www.exploit-db.com/exploits/42203/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9742","description":"The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9756","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9756","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9756","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9756"},"relatedVulnerabilities":[{"id":"CVE-2017-9756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9756","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9756","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"urls":["http://www.securityfocus.com/bid/99103","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21595","https://www.exploit-db.com/exploits/42204/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9756","description":"The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-77gc-v2xv-rvvh","versionConstraint":">=2.4.0,<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-77gc-v2xv-rvvh","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25287","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25287","date":"2026-10-08","epss":0.02931,"percentile":0.86682}],"risk":2.4107475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25287","https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh","description":"Out-of-bounds Read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25287","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25287","date":"2026-10-08","epss":0.02931,"percentile":0.86682}],"urls":["https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25287","description":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pw27-w7w4-9qc7","versionConstraint":"<1.8.10 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pw27-w7w4-9qc7","fix":{"state":"fixed","versions":["1.8.10"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2512","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2512","date":"2026-10-08","epss":0.04053,"percentile":0.90384}],"risk":2.4014024999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-2512","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://web.archive.org/web/20210123090815/http://www.securityfocus.com/bid/83879","https://web.archive.org/web/20210413200202/http://www.securitytracker.com/id/1035152","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350","https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380","https://www.djangoproject.com/weblog/2016/mar/01/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-15.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pw27-w7w4-9qc7","description":"Django XSS Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2016-2512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2512","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2512","date":"2026-10-08","epss":0.04053,"percentile":0.90384}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/bid/83879","http://www.securitytracker.com/id/1035152","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://www.djangoproject.com/weblog/2016/mar/01/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9840","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9840","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"risk":2.3965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9840"},"relatedVulnerabilities":[{"id":"CVE-2016-9840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402345","https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9840","description":"inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9840","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9840","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"risk":2.3965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9840"},"relatedVulnerabilities":[{"id":"CVE-2016-9840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402345","https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9840","description":"inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.14"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.6.14||>= 3.7.0, < 3.7.11||>= 3.8.0, < 3.8.10||>= 3.9.0, < 3.9.5||= 3.10.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.6.14","3.7.11","3.8.10","3.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.14"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.3959374999999996,"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-95q3-8gr9-gm8w","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-95q3-8gr9-gm8w","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27923","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27923","date":"2026-10-08","epss":0.03045,"percentile":0.87146}],"risk":2.3751,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27923","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-42.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w","description":"Pillow Denial of Service by Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27923","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27923","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27923","date":"2026-10-08","epss":0.03045,"percentile":0.87146}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27923","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9747","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9747","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"risk":2.3577,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9747"},"relatedVulnerabilities":[{"id":"CVE-2017-9747","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9747","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9747","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"urls":["http://www.securityfocus.com/bid/99114","https://sourceware.org/bugzilla/show_bug.cgi?id=21581","https://www.exploit-db.com/exploits/42200/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9747","description":"The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9748","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9748","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"risk":2.3577,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9748"},"relatedVulnerabilities":[{"id":"CVE-2017-9748","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9748","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9748","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"urls":["http://www.securityfocus.com/bid/99110","https://sourceware.org/bugzilla/show_bug.cgi?id=21582","https://www.exploit-db.com/exploits/42202/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9748","description":"The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug."}]},{"artifact":{"id":"9d758eb3ff53db62","cpes":["cpe:2.3:a:pip_developers_project:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:19.1.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@19.1.1","type":"python","version":"19.1.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"19.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gpvv-69j7-gwj8","versionConstraint":"<19.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"19.1.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gpvv-69j7-gwj8","fix":{"state":"fixed","versions":["19.2"],"available":[{"date":"2021-06-10","kind":"first-observed","version":"19.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20916","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20916","date":"2026-10-08","epss":0.03003,"percentile":0.86987}],"risk":2.34234,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-20916","https://github.com/pypa/pip/issues/6413","https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace","https://github.com/pypa/pip/compare/19.1.1...19.2","https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2020-173.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gpvv-69j7-gwj8","description":"Path Traversal in pip"},"relatedVulnerabilities":[{"id":"CVE-2019-20916","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20916","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20916","date":"2026-10-08","epss":0.03003,"percentile":0.86987}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html","https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace","https://github.com/pypa/pip/compare/19.1.1...19.2","https://github.com/pypa/pip/issues/6413","https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20916","description":"The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py."}]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.6.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38jv-5279-wg99","versionConstraint":">=1.22,<2.6.3 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-38jv-5279-wg99","fix":{"state":"fixed","versions":["2.6.3"],"available":[{"date":"2026-01-08","kind":"first-observed","version":"2.6.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-21441","cwe":"CWE-409","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21441","date":"2026-10-08","epss":0.02922,"percentile":0.86636}],"risk":2.29377,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://nvd.nist.gov/vuln/detail/CVE-2026-21441","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38jv-5279-wg99","description":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"},"relatedVulnerabilities":[{"id":"CVE-2026-21441","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-21441","cwe":"CWE-409","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21441","date":"2026-10-08","epss":0.02922,"percentile":0.86636}],"urls":["https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html","https://access.redhat.com/errata/RHSA-2026:0981","https://access.redhat.com/errata/RHSA-2026:0990","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:1038","https://access.redhat.com/errata/RHSA-2026:1041","https://access.redhat.com/errata/RHSA-2026:1042","https://access.redhat.com/errata/RHSA-2026:1086","https://access.redhat.com/errata/RHSA-2026:1087","https://access.redhat.com/errata/RHSA-2026:1088","https://access.redhat.com/errata/RHSA-2026:1089","https://access.redhat.com/errata/RHSA-2026:1166","https://access.redhat.com/errata/RHSA-2026:1168","https://access.redhat.com/errata/RHSA-2026:1176","https://access.redhat.com/errata/RHSA-2026:1224","https://access.redhat.com/errata/RHSA-2026:1226","https://access.redhat.com/errata/RHSA-2026:1239","https://access.redhat.com/errata/RHSA-2026:1240","https://access.redhat.com/errata/RHSA-2026:1241","https://access.redhat.com/errata/RHSA-2026:1254","https://access.redhat.com/errata/RHSA-2026:1485","https://access.redhat.com/errata/RHSA-2026:14877","https://access.redhat.com/errata/RHSA-2026:1504","https://access.redhat.com/errata/RHSA-2026:1546","https://access.redhat.com/errata/RHSA-2026:1596","https://access.redhat.com/errata/RHSA-2026:1599","https://access.redhat.com/errata/RHSA-2026:1609","https://access.redhat.com/errata/RHSA-2026:1618","https://access.redhat.com/errata/RHSA-2026:1619","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:1674","https://access.redhat.com/errata/RHSA-2026:1676","https://access.redhat.com/errata/RHSA-2026:1693","https://access.redhat.com/errata/RHSA-2026:1704","https://access.redhat.com/errata/RHSA-2026:1706","https://access.redhat.com/errata/RHSA-2026:1712","https://access.redhat.com/errata/RHSA-2026:1717","https://access.redhat.com/errata/RHSA-2026:1726","https://access.redhat.com/errata/RHSA-2026:1729","https://access.redhat.com/errata/RHSA-2026:1730","https://access.redhat.com/errata/RHSA-2026:1734","https://access.redhat.com/errata/RHSA-2026:1735","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:17456","https://access.redhat.com/errata/RHSA-2026:17457","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17461","https://access.redhat.com/errata/RHSA-2026:17462","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:1791","https://access.redhat.com/errata/RHSA-2026:1792","https://access.redhat.com/errata/RHSA-2026:1793","https://access.redhat.com/errata/RHSA-2026:1794","https://access.redhat.com/errata/RHSA-2026:1803","https://access.redhat.com/errata/RHSA-2026:1805","https://access.redhat.com/errata/RHSA-2026:1942","https://access.redhat.com/errata/RHSA-2026:1957","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2106","https://access.redhat.com/errata/RHSA-2026:2126","https://access.redhat.com/errata/RHSA-2026:2137","https://access.redhat.com/errata/RHSA-2026:2139","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2256","https://access.redhat.com/errata/RHSA-2026:2456","https://access.redhat.com/errata/RHSA-2026:2500","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2695","https://access.redhat.com/errata/RHSA-2026:2717","https://access.redhat.com/errata/RHSA-2026:2718","https://access.redhat.com/errata/RHSA-2026:2723","https://access.redhat.com/errata/RHSA-2026:2728","https://access.redhat.com/errata/RHSA-2026:2760","https://access.redhat.com/errata/RHSA-2026:2762","https://access.redhat.com/errata/RHSA-2026:2764","https://access.redhat.com/errata/RHSA-2026:2765","https://access.redhat.com/errata/RHSA-2026:28043","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2911","https://access.redhat.com/errata/RHSA-2026:2919","https://access.redhat.com/errata/RHSA-2026:2924","https://access.redhat.com/errata/RHSA-2026:2925","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:3406","https://access.redhat.com/errata/RHSA-2026:3444","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:4185","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:4215","https://access.redhat.com/errata/RHSA-2026:4271","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:44696","https://access.redhat.com/errata/RHSA-2026:51357","https://access.redhat.com/errata/RHSA-2026:5459","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:6287","https://access.redhat.com/errata/RHSA-2026:6292","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8500","https://access.redhat.com/errata/RHSA-2026:8501","https://access.redhat.com/security/cve/CVE-2026-21441","https://bugzilla.redhat.com/show_bug.cgi?id=2427726","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441","description":"urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source."}]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.24.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mh33-7rrq-662w","versionConstraint":"<1.24.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-mh33-7rrq-662w","fix":{"state":"fixed","versions":["1.24.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.24.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11324","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11324","date":"2026-10-08","epss":0.02915,"percentile":0.86606}],"risk":2.2737,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-11324","https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://www.openwall.com/lists/oss-security/2019/04/19/1","https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-133.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2","https://pypi.org/project/urllib3/1.24.2","https://usn.ubuntu.com/3990-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mh33-7rrq-662w","description":"Improper Certificate Validation in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2019-11324","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11324","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11324","date":"2026-10-08","epss":0.02915,"percentile":0.86606}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://www.openwall.com/lists/oss-security/2019/04/19/1","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/","https://usn.ubuntu.com/3990-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11324","description":"The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-43fq-w8qq-v88h","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-43fq-w8qq-v88h","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11538","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11538","date":"2026-10-08","epss":0.02514,"percentile":0.84326}],"risk":2.2186049999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-11538","https://github.com/python-pillow/Pillow/pull/4504","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d","https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://usn.ubuntu.com/4430-1","https://usn.ubuntu.com/4430-2"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-43fq-w8qq-v88h","description":"Out-of-bounds read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-11538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11538","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11538","date":"2026-10-08","epss":0.02514,"percentile":0.84326}],"urls":["https://github.com/python-pillow/Pillow/pull/4504","https://github.com/python-pillow/Pillow/pull/4538","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://usn.ubuntu.com/4430-1/","https://usn.ubuntu.com/4430-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11538","description":"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9j59-75qj-795w","versionConstraint":"<9.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-9j59-75qj-795w","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2022-03-12","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24303","date":"2026-10-08","epss":0.02691,"percentile":0.85449}],"risk":2.2133475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24303","https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml","https://security.gentoo.org/glsa/202211-10","https://github.com/python-pillow/Pillow/pull/6010","https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781","https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a","https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP","https://github.com/python-pillow/Pillow/pull/3450"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9j59-75qj-795w","description":"Path traversal in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-24303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24303","date":"2026-10-08","epss":0.02691,"percentile":0.85449}],"urls":["https://github.com/python-pillow/Pillow/pull/3450","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303","description":"Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1387","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1387","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"risk":2.213,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1387"},"relatedVulnerabilities":[{"id":"CVE-2019-1387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2019:4356","https://access.redhat.com/errata/RHSA-2020:0002","https://access.redhat.com/errata/RHSA-2020:0124","https://access.redhat.com/errata/RHSA-2020:0228","https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1387","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1387","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1387","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"risk":2.213,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1387"},"relatedVulnerabilities":[{"id":"CVE-2019-1387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2019:4356","https://access.redhat.com/errata/RHSA-2020:0002","https://access.redhat.com/errata/RHSA-2020:0124","https://access.redhat.com/errata/RHSA-2020:0228","https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1387","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."}]},{"artifact":{"id":"219d2718cef52c0e","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12243","versionConstraint":"< 2.4.40+dfsg-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12243","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"risk":2.2115,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12243"},"relatedVulnerabilities":[{"id":"CVE-2020-12243","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html","https://bugs.openldap.org/show_bug.cgi?id=9202","https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES","https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440","https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html","https://security.netapp.com/advisory/ntap-20200511-0003/","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4352-1/","https://usn.ubuntu.com/4352-2/","https://www.debian.org/security/2020/dsa-4666","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."}]},{"artifact":{"id":"6e45ea8380d3353e","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-18197","versionConstraint":"< 1.1.28-2+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-18197","fix":{"state":"fixed","versions":["1.1.28-2+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"risk":2.181,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-18197"},"relatedVulnerabilities":[{"id":"CVE-2019-18197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://access.redhat.com/errata/RHSA-2020:0514","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914","https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285","https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html","https://security.netapp.com/advisory/ntap-20191031-0004/","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197","description":"In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed."}]},{"artifact":{"id":"a70c9c759e956fd7","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u4:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u4","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-18197","versionConstraint":"< 1.1.28-2+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-18197","fix":{"state":"fixed","versions":["1.1.28-2+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"risk":2.181,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-18197"},"relatedVulnerabilities":[{"id":"CVE-2019-18197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://access.redhat.com/errata/RHSA-2020:0514","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914","https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285","https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html","https://security.netapp.com/advisory/ntap-20191031-0004/","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197","description":"In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57h3-9rgr-c24m","versionConstraint":">=0,<8.1.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-57h3-9rgr-c24m","fix":{"state":"fixed","versions":["8.1.1"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"8.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25289","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25289","date":"2026-10-08","epss":0.02345,"percentile":0.83136}],"risk":2.1749875,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25289","https://github.com/python-pillow/Pillow/commit/3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-35.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57h3-9rgr-c24m","description":"Out of bounds write in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25289","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25289","date":"2026-10-08","epss":0.02345,"percentile":0.83136}],"urls":["https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25289","description":"An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2226","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2226","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2226","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2226","date":"2026-10-08","epss":0.07234,"percentile":0.94177}],"risk":2.1702,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2226"},"relatedVulnerabilities":[{"id":"CVE-2016-2226","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2226","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2226","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2226","date":"2026-10-08","epss":0.07234,"percentile":0.94177}],"urls":["http://www.openwall.com/lists/oss-security/2016/05/05/5","http://www.securityfocus.com/bid/90103","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687","https://www.exploit-db.com/exploits/42386/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11655","versionConstraint":"< 3.8.7.1-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11655","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11655","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11655","date":"2026-10-08","epss":0.0434,"percentile":0.90952}],"risk":2.17,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11655"},"relatedVulnerabilities":[{"id":"CVE-2020-11655","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11655","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11655","date":"2026-10-08","epss":0.0434,"percentile":0.90952}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc","https://security.gentoo.org/glsa/202007-26","https://security.netapp.com/advisory/ntap-20200416-0001/","https://usn.ubuntu.com/4394-1/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-14","https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11","https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11655","description":"SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled."}]},{"artifact":{"id":"b8ecf169f06de613","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u15?arch=amd64&distro=debian-8.11&upstream=curl","type":"deb","version":"7.38.0-4+deb8u15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"curl","version":"7.38.0-4+deb8u15"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8625","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8625","date":"2026-10-08","epss":0.04321,"percentile":0.90916}],"risk":2.1605,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8625"},"relatedVulnerabilities":[{"id":"CVE-2016-8625","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8625","date":"2026-10-08","epss":0.04321,"percentile":0.90916}],"urls":["http://www.securityfocus.com/bid/94107","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625","https://curl.haxx.se/CVE-2016-8625.patch","https://curl.haxx.se/docs/adv_20161102K.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8625","description":"curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host."}]},{"artifact":{"id":"9bb8f4339906ad80","cpes":["cpe:2.3:a:lxml:lxml:4.3.4:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@4.3.4","type":"python","version":"4.3.4","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jq4v-f5q6-mjqq","versionConstraint":"<4.6.3 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"4.3.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-jq4v-f5q6-mjqq","fix":{"state":"fixed","versions":["4.6.3"],"available":[{"date":"2021-03-23","kind":"first-observed","version":"4.6.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28957","date":"2026-10-08","epss":0.04035,"percentile":0.90344}],"risk":2.1587249999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28957","https://github.com/lxml/lxml/pull/316","https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d","https://bugs.launchpad.net/lxml/+bug/1888153","https://pypi.org/project/lxml","https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://www.debian.org/security/2021/dsa-4880","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.gentoo.org/glsa/202208-06","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ","https://security.netapp.com/advisory/ntap-20210521-0004"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jq4v-f5q6-mjqq","description":"lxml vulnerable to Cross-Site Scripting"},"relatedVulnerabilities":[{"id":"CVE-2021-28957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28957","date":"2026-10-08","epss":0.04035,"percentile":0.90344}],"urls":["https://bugs.launchpad.net/lxml/+bug/1888153","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20210521-0004/","https://www.debian.org/security/2021/dsa-4880","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28957","description":"An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3."}]},{"artifact":{"id":"9bb8f4339906ad80","cpes":["cpe:2.3:a:lxml:lxml:4.3.4:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@4.3.4","type":"python","version":"4.3.4","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pgww-xf46-h92r","versionConstraint":"<4.6.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"4.3.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pgww-xf46-h92r","fix":{"state":"fixed","versions":["4.6.2"],"available":[{"date":"2021-01-08","kind":"first-observed","version":"4.6.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-27783","date":"2026-10-08","epss":0.03982,"percentile":0.90227}],"risk":2.1303699999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-27783","https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7","https://bugzilla.redhat.com/show_bug.cgi?id=1901633","https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","https://snyk.io/vuln/SNYK-PYTHON-LXML-1047473","https://www.debian.org/security/2020/dsa-4810","https://advisory.checkmarx.net/advisory/CX-2020-4286","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2020-62.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK","https://pypi.org/project/lxml","https://security.netapp.com/advisory/ntap-20210521-0003","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pgww-xf46-h92r","description":"lxml vulnerable to Cross-site Scripting"},"relatedVulnerabilities":[{"id":"CVE-2020-27783","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-27783","date":"2026-10-08","epss":0.03982,"percentile":0.90227}],"urls":["https://advisory.checkmarx.net/advisory/CX-2020-4286","https://bugzilla.redhat.com/show_bug.cgi?id=1901633","https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/","https://security.netapp.com/advisory/ntap-20210521-0003/","https://www.debian.org/security/2020/dsa-4810","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-27783","description":"A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-16168","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16168","date":"2026-10-08","epss":0.04253,"percentile":0.90799}],"risk":2.1265,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16168"},"relatedVulnerabilities":[{"id":"CVE-2019-16168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16168","date":"2026-10-08","epss":0.04253,"percentile":0.90799}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/","https://security.gentoo.org/glsa/202003-16","https://security.netapp.com/advisory/ntap-20190926-0003/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4205-1/","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62","https://www.sqlite.org/src/timeline?c=98357d8c1263920b","https://www.tenable.com/security/tns-2021-08","https://www.tenable.com/security/tns-2021-11","https://www.tenable.com/security/tns-2021-14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\""}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hj69-c76v-86wr","versionConstraint":"<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hj69-c76v-86wr","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5313","date":"2026-10-08","epss":0.02752,"percentile":0.85795}],"risk":2.09152,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5313","https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-84.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hj69-c76v-86wr","description":"Out-of-bounds Read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5313","date":"2026-10-08","epss":0.02752,"percentile":0.85795}],"urls":["https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5313","description":"libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-14155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"risk":2.091,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-14155"},"relatedVulnerabilities":[{"id":"CVE-2020-14155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"urls":["http://seclists.org/fulldisclosure/2020/Dec/32","http://seclists.org/fulldisclosure/2021/Feb/14","https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/","https://bugs.gentoo.org/717920","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20221028-0010/","https://support.apple.com/kb/HT211931","https://support.apple.com/kb/HT212147","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.pcre.org/original/changelog.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14155","description":"libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring."}]},{"artifact":{"id":"a7735a434db9c1fb","cpes":["cpe:2.3:a:daniel_holth_project:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth_project:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth_project:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:wheel:python-wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:wheel:python_wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:dholth:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:python:wheel:0.33.4:*:*:*:*:*:*:*","cpe:2.3:a:wheel:wheel:0.33.4:*:*:*:*:*:*:*"],"name":"wheel","purl":"pkg:pypi/wheel@0.33.4","type":"python","version":"0.33.4","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.33.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.38.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qwmp-2cf2-g9g6","versionConstraint":"<0.38.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"wheel","version":"0.33.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-qwmp-2cf2-g9g6","fix":{"state":"fixed","versions":["0.38.1"],"available":[{"date":"2022-12-27","kind":"first-observed","version":"0.38.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40898","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40898","date":"2026-10-08","epss":0.02735,"percentile":0.85678}],"risk":2.05125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40898","https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18","https://github.com/pypa/advisory-database/tree/main/vulns/wheel/PYSEC-2022-43017.yaml","https://pypi.org/project/wheel","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://pyup.io/vulnerabilities/CVE-2022-40898/51499"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qwmp-2cf2-g9g6","description":"pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2022-40898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40898","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40898","date":"2026-10-08","epss":0.02735,"percentile":0.85678}],"urls":["https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18","https://pypi.org/project/wheel/","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"6f015932bb925b0f","cpes":["cpe:2.3:a:login:login:1\\:4.2-3\\+deb8u4:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.2-3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=shadow","type":"deb","version":"1:4.2-3+deb8u4","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/login.preinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12424","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"shadow","version":"1:4.2-3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12424","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"risk":1.9942499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12424"},"relatedVulnerabilities":[{"id":"CVE-2017-12424","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630","https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675","https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952","https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html","https://security.gentoo.org/glsa/201710-16"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12424","description":"In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts."}]},{"artifact":{"id":"d360b6f3245d4904","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.2-3\\+deb8u4:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/debian/passwd@1%3A4.2-3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=shadow","type":"deb","version":"1:4.2-3+deb8u4","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/passwd.preinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12424","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"shadow","version":"1:4.2-3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12424","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"risk":1.9942499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12424"},"relatedVulnerabilities":[{"id":"CVE-2017-12424","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630","https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675","https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952","https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html","https://security.gentoo.org/glsa/201710-16"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12424","description":"In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.16||>= 3.10.0a0, < 3.10.9||>= 3.11.0a0, < 3.11.1||>= 3.12.0a0, < 3.12.0a3||>= 3.8.0a0, < 3.8.16||>= 3.9.0a0, < 3.9.16 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.16||>= 3.10.0a0, < 3.10.9||>= 3.11.0a0, < 3.11.1||>= 3.12.0a0, < 3.12.0a3||>= 3.8.0a0, < 3.8.16||>= 3.9.0a0, < 3.9.16 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.16","3.8.16","3.9.16","3.10.9","3.11.1","3.12.0a3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.7.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.9"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.0a3"},{"date":"2026-09-22","kind":"first-observed","version":"3.8.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.1"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.0a3"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.16"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rwv7-3v45-hg29","versionConstraint":">=2.4.0,<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-rwv7-3v45-hg29","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25288","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25288","date":"2026-10-08","epss":0.02388,"percentile":0.83436}],"risk":1.96413,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25288","https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rwv7-3v45-hg29","description":"Pillow Out-of-bounds Read vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2021-25288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25288","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25288","date":"2026-10-08","epss":0.02388,"percentile":0.83436}],"urls":["https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25288","description":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"cbc8e569ed6f5bfc","cpes":["cpe:2.3:a:python:setuptools:41.0.1:*:*:*:*:*:*:*"],"name":"setuptools","purl":"pkg:pypi/setuptools@41.0.1","type":"python","version":"41.0.1","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"65.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r9hx-vwmv-q579","versionConstraint":"<65.5.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"setuptools","version":"41.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-r9hx-vwmv-q579","fix":{"state":"fixed","versions":["65.5.1"],"available":[{"date":"2022-12-28","kind":"first-observed","version":"65.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40897","date":"2026-10-08","epss":0.02503,"percentile":0.84248}],"risk":1.95234,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40897","https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://github.com/pypa/setuptools/issues/3659","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://pyup.io/vulnerabilities/CVE-2022-40897/52495","https://security.netapp.com/advisory/ntap-20230214-0001","https://security.netapp.com/advisory/ntap-20240621-0006","https://setuptools.pypa.io/en/latest","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r9hx-vwmv-q579","description":"pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2022-40897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40897","date":"2026-10-08","epss":0.02503,"percentile":0.84248}],"urls":["https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","https://pyup.io/vulnerabilities/CVE-2022-40897/52495/","https://security.netapp.com/advisory/ntap-20230214-0001/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40897","description":"Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r7m-5h27-29hp","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-7r7m-5h27-29hp","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28676","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28676","date":"2026-10-08","epss":0.02501,"percentile":0.84228}],"risk":1.9507800000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28676","https://github.com/python-pillow/Pillow/pull/5377","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r7m-5h27-29hp","description":"Potential infinite loop in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-28676","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28676","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28676","date":"2026-10-08","epss":0.02501,"percentile":0.84228}],"urls":["https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856","https://github.com/python-pillow/Pillow/pull/5377","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28676","description":"An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-11008","versionConstraint":"< 1:2.1.4-2.1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11008","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"risk":1.9335000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11008"},"relatedVulnerabilities":[{"id":"CVE-2020-11008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://seclists.org/fulldisclosure/2020/May/41","https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211183","https://usn.ubuntu.com/4334-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11008","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a \"blank\" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's \"store\" helper - Git's \"cache\" helper - the \"osxkeychain\" helper that ships in Git's \"contrib\" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11008","versionConstraint":"< 1:2.1.4-2.1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11008","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"risk":1.9335000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11008"},"relatedVulnerabilities":[{"id":"CVE-2020-11008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://seclists.org/fulldisclosure/2020/May/41","https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211183","https://usn.ubuntu.com/4334-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11008","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a \"blank\" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's \"store\" helper - Git's \"cache\" helper - the \"osxkeychain\" helper that ships in Git's \"contrib\" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability."}]},{"artifact":{"id":"414639da26c31e4a","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"558b00f322f756d1","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"7cf79494255d936c","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u11:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u11?arch=amd64&distro=debian-8.11","type":"deb","version":"1.0.1t-1+deb8u11","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:f329135c5ad7f31ddaae7d74b936f63869aad39dabb2d0f9bf125fe21712b6cd","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-6969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-6969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-6969","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6969","date":"2026-10-08","epss":0.03794,"percentile":0.89711}],"risk":1.897,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-6969"},"relatedVulnerabilities":[{"id":"CVE-2017-6969","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6969","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6969","date":"2026-10-08","epss":0.03794,"percentile":0.89711}],"urls":["http://www.securityfocus.com/bid/97065","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21156"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6969","description":"readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well."}]},{"artifact":{"id":"ab243b55bd915538","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u3","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17498","versionConstraint":"< 1.4.3-4.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17498","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"risk":1.881,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17498"},"relatedVulnerabilities":[{"id":"CVE-2019-17498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html","http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/","https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498","https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480","https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c","https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/","https://security.netapp.com/advisory/ntap-20220909-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17498","description":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8xjq-8fcg-g5hw","versionConstraint":">=0,<8.1.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8xjq-8fcg-g5hw","fix":{"state":"fixed","versions":["8.1.1"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"8.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25290","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25290","date":"2026-10-08","epss":0.02372,"percentile":0.83329}],"risk":1.8501600000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25290","https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-36.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw","description":"Out-of-bounds Write in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25290","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25290","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25290","date":"2026-10-08","epss":0.02372,"percentile":0.83329}],"urls":["https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25290","description":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5hq-fp76-qmrc","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q5hq-fp76-qmrc","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28677","date":"2026-10-08","epss":0.02338,"percentile":0.83082}],"risk":1.8236400000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28677","https://github.com/python-pillow/Pillow/pull/5377","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc","description":"Uncontrolled Resource Consumption in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-28677","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28677","date":"2026-10-08","epss":0.02338,"percentile":0.83082}],"urls":["https://github.com/python-pillow/Pillow/pull/5377","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28677","description":"An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20218","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20218","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20218","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20218","date":"2026-10-08","epss":0.03622,"percentile":0.89215}],"risk":1.8110000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20218"},"relatedVulnerabilities":[{"id":"CVE-2019-20218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20218","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20218","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20218","date":"2026-10-08","epss":0.03622,"percentile":0.89215}],"urls":["https://github.com/sqlite/sqlite/commit/a6c1a71cde082e09750465d5675699062922e387","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00016.html","https://security.gentoo.org/glsa/202007-26","https://usn.ubuntu.com/4298-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20218","description":"selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-20852","versionConstraint":">= 2.0, <= 2.7.16||>= 3.0.0, < 3.4.10||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-20852","fix":{"state":"fixed","versions":["3.4.10","3.5.7","3.6.9","3.7.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.4.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20852","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20852","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20852","date":"2026-10-08","epss":0.03668,"percentile":0.89348}],"risk":1.8095466666666666,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue35121","https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://python-security.readthedocs.io/vuln/cookie-domain-check.html","https://security.gentoo.org/glsa/202003-26","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20852","description":"http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-18348","versionConstraint":">= 2.0, <= 2.7.17||>= 3.0, < 3.5.10||>= 3.6.0, < 3.6.11||>= 3.7.0, < 3.7.8||>= 3.8.0, < 3.8.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-18348","fix":{"state":"fixed","versions":["3.5.10","3.6.11","3.7.8","3.8.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.5.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18348","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18348","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18348","date":"2026-10-08","epss":0.03513,"percentile":0.88887}],"risk":1.8033400000000002,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html","https://bugs.python.org/issue30458#msg347282","https://bugzilla.redhat.com/show_bug.cgi?id=1727276","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://security.netapp.com/advisory/ntap-20191107-0004/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18348","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1."},"relatedVulnerabilities":[]},{"artifact":{"id":"aebc716b731a9dc5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.7","type":"python","version":"2.7","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hggm-jpg3-v476","versionConstraint":"<3.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.7"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hggm-jpg3-v476","fix":{"state":"fixed","versions":["3.2"],"available":[{"date":"2020-10-28","kind":"first-observed","version":"3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25659","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25659","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25659","date":"2026-10-08","epss":0.02463,"percentile":0.8398}],"risk":1.7918325,"urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-hggm-jpg3-v476","https://github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494","https://nvd.nist.gov/vuln/detail/CVE-2020-25659","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pyca/cryptography/pull/5507","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2021-62.yaml","https://pypi.org/project/cryptography"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hggm-jpg3-v476","description":"RSA decryption vulnerable to Bleichenbacher timing vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2020-25659","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25659","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25659","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25659","date":"2026-10-08","epss":0.02463,"percentile":0.8398}],"urls":["https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25659","description":"python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vcqg-3p29-xw73","versionConstraint":">=0,<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vcqg-3p29-xw73","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2021-11-04","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5310","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5310","date":"2026-10-08","epss":0.01975,"percentile":0.79844}],"risk":1.7824375000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5310","https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vcqg-3p29-xw73","description":"Integer overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5310","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5310","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5310","date":"2026-10-08","epss":0.01975,"percentile":0.79844}],"urls":["https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310","description":"libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14939","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14939","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14939","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14939","date":"2026-10-08","epss":0.05941,"percentile":0.93084}],"risk":1.7822999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14939"},"relatedVulnerabilities":[{"id":"CVE-2017-14939","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14939","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14939","date":"2026-10-08","epss":0.05941,"percentile":0.93084}],"urls":["http://www.securityfocus.com/bid/101216","https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read_1_byte-dwarf2-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22169","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=515f23e63c0074ab531bc954f84ca40c6281a724","https://www.exploit-db.com/exploits/42970/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14939","description":"decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte."}]},{"artifact":{"id":"ab5858e8afd43c06","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.42.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=glib2.0","type":"deb","version":"2.42.1-1+deb8u1","language":"","licenses":["sha256:fba5358de01b6b99d385f588714b3b7f64be7074710e4d4152bc3a05dfef1789"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.42.1-1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16429","versionConstraint":"< 2.42.1-1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glib2.0","version":"2.42.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16429","fix":{"state":"fixed","versions":["2.42.1-1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.42.1-1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16429","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16429","date":"2026-10-08","epss":0.03532,"percentile":0.88939}],"risk":1.7659999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16429"},"relatedVulnerabilities":[{"id":"CVE-2018-16429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16429","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16429","date":"2026-10-08","epss":0.03532,"percentile":0.88939}],"urls":["https://gitlab.gnome.org/GNOME/glib/commit/cec71705406f0b2790422f0c1aa0ff3b4b464b1b","https://gitlab.gnome.org/GNOME/glib/issues/1361","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html","https://usn.ubuntu.com/3767-1/","https://usn.ubuntu.com/3767-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16429","description":"GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str()."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-08","epss":0.02303,"percentile":0.82804}],"risk":1.72725,"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2014-9939","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9939","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9939","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9939","date":"2026-10-08","epss":0.02284,"percentile":0.82634}],"risk":1.7129999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9939"},"relatedVulnerabilities":[{"id":"CVE-2014-9939","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9939","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9939","date":"2026-10-08","epss":0.02284,"percentile":0.82634}],"urls":["http://www.openwall.com/lists/oss-security/2015/07/31/6","https://sourceware.org/bugzilla/show_bug.cgi?id=18750","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7e27a9d5f22f9f7ead11738b1546d0b5c737266b"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9939","description":"ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1353","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1353","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"risk":1.683,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1353"},"relatedVulnerabilities":[{"id":"CVE-2019-1353","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1353","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1353","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1353","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"risk":1.683,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1353"},"relatedVulnerabilities":[{"id":"CVE-2019-1353","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1353","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active."}]},{"artifact":{"id":"aebc716b731a9dc5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.7","type":"python","version":"2.7","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"42.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9v9h-cgj8-h64p","versionConstraint":"<42.0.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.7"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-9v9h-cgj8-h64p","fix":{"state":"fixed","versions":["42.0.2"],"available":[{"date":"2024-02-17","kind":"first-observed","version":"42.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-0727","https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","https://github.com/github/advisory-database/pull/3472","https://github.com/openssl/openssl/pull/23362","https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2","https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d","https://security.netapp.com/advisory/ntap-20240208-0006","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9v9h-cgj8-h64p","description":"Null pointer dereference in PKCS12 parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-10-08","epss":0.02203,"percentile":0.81998}],"risk":1.6522500000000002,"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."},"relatedVulnerabilities":[]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gm3-px64-rw72","versionConstraint":">=0,<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-5gm3-px64-rw72","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19911","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19911","date":"2026-10-08","epss":0.02118,"percentile":0.81276}],"risk":1.6520400000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-19911","https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d","https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gm3-px64-rw72","description":"Uncontrolled Resource Consumption in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2019-19911","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19911","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19911","date":"2026-10-08","epss":0.02118,"percentile":0.81276}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19911","description":"There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer."}]},{"artifact":{"id":"7b63410c84605e26","cpes":["cpe:2.3:a:python:requests:2.18.4:*:*:*:*:*:*:*"],"name":"requests","purl":"pkg:pypi/requests@2.18.4","type":"python","version":"2.18.4","language":"python","licenses":["Apache 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.18.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j8r2-6x86-q33q","versionConstraint":">=2.3.0,<2.31.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"requests","version":"2.18.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j8r2-6x86-q33q","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2023-05-23","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32681","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-32681","date":"2026-10-08","epss":0.02974,"percentile":0.86852}],"risk":1.6505699999999999,"urls":["https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5","https://nvd.nist.gov/vuln/detail/CVE-2023-32681","https://github.com/psf/requests/releases/tag/v2.31.0","https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml","https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html","https://security.gentoo.org/glsa/202309-08","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j8r2-6x86-q33q","description":"Unintended leak of Proxy-Authorization header in requests"},"relatedVulnerabilities":[{"id":"CVE-2023-32681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32681","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-32681","date":"2026-10-08","epss":0.02974,"percentile":0.86852}],"urls":["https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5","https://github.com/psf/requests/releases/tag/v2.31.0","https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/","https://security.gentoo.org/glsa/202309-08"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681","description":"Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12799","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12799","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12799","date":"2026-10-08","epss":0.03298,"percentile":0.88173}],"risk":1.649,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12799"},"relatedVulnerabilities":[{"id":"CVE-2017-12799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12799","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12799","date":"2026-10-08","epss":0.03298,"percentile":0.88173}],"urls":["http://www.securityfocus.com/bid/100292","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21933"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12799","description":"The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file."}]},{"artifact":{"id":"a284d36292d34bb5","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"2c66ac55e59f687c","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"2bb02c4c2bc9c746","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"498487d330ddcae4","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"0a7e397d74eef190","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"467f832be225b5af","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"8e2f25b73814be4b","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"5c4c26abee9f8bd7","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"9af78a81e5684683","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-10373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10373","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10373","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10373","date":"2026-10-08","epss":0.03282,"percentile":0.88103}],"risk":1.641,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10373"},"relatedVulnerabilities":[{"id":"CVE-2018-10373","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10373","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10373","date":"2026-10-08","epss":0.03282,"percentile":0.88103}],"urls":["http://www.securityfocus.com/bid/104000","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201908-01","https://sourceware.org/bugzilla/show_bug.cgi?id=23065","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10373","description":"concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new."}]},{"artifact":{"id":"9bb8f4339906ad80","cpes":["cpe:2.3:a:lxml:lxml:4.3.4:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@4.3.4","type":"python","version":"4.3.4","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-55x5-fj6c-h6m8","versionConstraint":"<4.6.5 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"4.3.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-55x5-fj6c-h6m8","fix":{"state":"fixed","versions":["4.6.5"],"available":[{"date":"2021-12-14","kind":"first-observed","version":"4.6.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43818","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43818","date":"2026-10-08","epss":0.02663,"percentile":0.85272}],"risk":1.6310875000000002,"urls":["https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8","https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776","https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0","https://nvd.nist.gov/vuln/detail/CVE-2021-43818","https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html","https://www.debian.org/security/2022/dsa-5043","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202208-06","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44","https://security.netapp.com/advisory/ntap-20220107-0005"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-55x5-fj6c-h6m8","description":"lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through"},"relatedVulnerabilities":[{"id":"CVE-2021-43818","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"impactScore":3.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43818","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43818","date":"2026-10-08","epss":0.02663,"percentile":0.85272}],"urls":["https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776","https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0","https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8","https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20220107-0005/","https://www.debian.org/security/2022/dsa-5043","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818","description":"lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available."}]},{"artifact":{"id":"ab5858e8afd43c06","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.42.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.42.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=glib2.0","type":"deb","version":"2.42.1-1+deb8u1","language":"","licenses":["sha256:fba5358de01b6b99d385f588714b3b7f64be7074710e4d4152bc3a05dfef1789"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.42.1-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13012","versionConstraint":"< 2.42.1-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glib2.0","version":"2.42.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13012","fix":{"state":"fixed","versions":["2.42.1-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.42.1-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13012","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13012","date":"2026-10-08","epss":0.03211,"percentile":0.87802}],"risk":1.6055,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13012"},"relatedVulnerabilities":[{"id":"CVE-2019-13012","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13012","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13012","date":"2026-10-08","epss":0.03211,"percentile":0.87802}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00022.html","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931234#12","https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429","https://gitlab.gnome.org/GNOME/glib/issues/1658","https://gitlab.gnome.org/GNOME/glib/merge_requests/450","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html","https://lists.debian.org/debian-lts-announce/2019/08/msg00004.html","https://security.netapp.com/advisory/ntap-20190806-0003/","https://usn.ubuntu.com/4049-1/","https://usn.ubuntu.com/4049-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13012","description":"The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450."}]},{"artifact":{"id":"9ce65a8dd5f9de8a","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12%2Bdeb8u2?arch=all&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"ff79e707a754ecb1","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"d22e0dbc11f63e2c","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"ddda1e33a46008a7","cpes":["cpe:2.3:a:unbit_project:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info_project:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info:python-uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info:python_uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:python:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:unbit:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:uwsgi:2.0.18:*:*:*:*:*:*:*","cpe:2.3:a:info:uwsgi:2.0.18:*:*:*:*:*:*:*"],"name":"uwsgi","purl":"pkg:pypi/uwsgi@2.0.18","type":"python","version":"2.0.18","language":"python","licenses":["GPLv2+"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.18.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vcph-37mh-fqrh","versionConstraint":"<2.0.22 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"uwsgi","version":"2.0.18"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vcph-37mh-fqrh","fix":{"state":"fixed","versions":["2.0.22"],"available":[{"date":"2023-08-25","kind":"first-observed","version":"2.0.22"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27522","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-27522","date":"2026-10-08","epss":0.02134,"percentile":0.81431}],"risk":1.6005000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-27522","https://httpd.apache.org/security/vulnerabilities_24.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html","https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d","https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822","https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569","https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html","https://security.gentoo.org/glsa/202309-01"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vcph-37mh-fqrh","description":"Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling"},"relatedVulnerabilities":[{"id":"CVE-2023-27522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27522","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-27522","date":"2026-10-08","epss":0.02134,"percentile":0.81431}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html","https://security.gentoo.org/glsa/202309-01","https://github.com/advisories/GHSA-vcph-37mh-fqrh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27522","description":"HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-20388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"risk":1.5725,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20388"},"relatedVulnerabilities":[{"id":"CVE-2019-20388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20388","description":"xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"risk":1.5725,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20388"},"relatedVulnerabilities":[{"id":"CVE-2019-20388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20388","description":"xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12967","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12967","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12967","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12967","date":"2026-10-08","epss":0.03101,"percentile":0.87368}],"risk":1.5505,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12967"},"relatedVulnerabilities":[{"id":"CVE-2017-12967","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12967","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12967","date":"2026-10-08","epss":0.03101,"percentile":0.87368}],"urls":["http://www.securityfocus.com/bid/100462","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21962"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12967","description":"The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary."}]},{"artifact":{"id":"cbc8e569ed6f5bfc","cpes":["cpe:2.3:a:python:setuptools:41.0.1:*:*:*:*:*:*:*"],"name":"setuptools","purl":"pkg:pypi/setuptools@41.0.1","type":"python","version":"41.0.1","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"70.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cx63-2mw6-8hw5","versionConstraint":"<70.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"setuptools","version":"41.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-cx63-2mw6-8hw5","fix":{"state":"fixed","versions":["70.0.0"],"available":[{"date":"2024-07-16","kind":"first-observed","version":"70.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-10-08","epss":0.01939,"percentile":0.79511}],"risk":1.5172675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-6345","https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://github.com/pypa/setuptools/pull/4332","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cx63-2mw6-8hw5","description":"setuptools vulnerable to Command Injection via package URL"},"relatedVulnerabilities":[{"id":"CVE-2024-6345","cvss":[{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-10-08","epss":0.01939,"percentile":0.79511}],"urls":["https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html","https://github.com/advisories/GHSA-cx63-2mw6-8hw5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345","description":"A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pw3c-h7wp-cvhx","versionConstraint":"<9.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pw3c-h7wp-cvhx","fix":{"state":"fixed","versions":["9.0.0"],"available":[{"date":"2022-01-13","kind":"first-observed","version":"9.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22815","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22815","date":"2026-10-08","epss":0.02578,"percentile":0.84743}],"risk":1.50813,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22815","https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://www.debian.org/security/2022/dsa-5053","https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c","https://github.com/python-pillow/Pillow/pull/5920","https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c","https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx","description":"Improper Initialization in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-22815","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22815","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22815","date":"2026-10-08","epss":0.02578,"percentile":0.84743}],"urls":["https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://security.gentoo.org/glsa/202211-10","https://www.debian.org/security/2022/dsa-5053"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815","description":"path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3f63-hfp8-52jq","versionConstraint":"<10.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3f63-hfp8-52jq","fix":{"state":"fixed","versions":["10.2.0"],"available":[{"date":"2024-01-23","kind":"first-observed","version":"10.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50447","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50447","cwe":"CWE-95","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50447","date":"2026-10-08","epss":0.01703,"percentile":0.76541}],"risk":1.507155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-50447","https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a","https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security","http://www.openwall.com/lists/oss-security/2024/01/20/1","https://github.com/python-pillow/Pillow/releases","https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html","https://devhub.checkmarx.com/cve-details/CVE-2023-50447","https://duartecsantos.github.io/2023-01-02-CVE-2023-50447","https://duartecsantos.github.io/2024-01-02-CVE-2023-50447"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3f63-hfp8-52jq","description":"Arbitrary Code Execution in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2023-50447","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50447","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50447","cwe":"CWE-95","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50447","date":"2026-10-08","epss":0.01703,"percentile":0.76541}],"urls":["http://www.openwall.com/lists/oss-security/2024/01/20/1","https://devhub.checkmarx.com/cve-details/CVE-2023-50447/","https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/","https://github.com/python-pillow/Pillow/releases","https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447","description":"Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter)."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11745","versionConstraint":"< 2:3.26-1+debu8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11745","fix":{"state":"fixed","versions":["2:3.26-1+debu8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11745","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11745","date":"2026-10-08","epss":0.02994,"percentile":0.86944}],"risk":1.497,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11745"},"relatedVulnerabilities":[{"id":"CVE-2019-11745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11745","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11745","date":"2026-10-08","epss":0.02994,"percentile":0.86944}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html","https://access.redhat.com/errata/RHSA-2020:0243","https://access.redhat.com/errata/RHSA-2020:0466","https://bugzilla.mozilla.org/show_bug.cgi?id=1586176","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/202003-02","https://security.gentoo.org/glsa/202003-10","https://security.gentoo.org/glsa/202003-37","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","https://usn.ubuntu.com/4241-1/","https://usn.ubuntu.com/4335-1/","https://www.mozilla.org/security/advisories/mfsa2019-36/","https://www.mozilla.org/security/advisories/mfsa2019-37/","https://www.mozilla.org/security/advisories/mfsa2019-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11745","description":"When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11745","versionConstraint":"< 2:3.26-1+debu8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11745","fix":{"state":"fixed","versions":["2:3.26-1+debu8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11745","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11745","date":"2026-10-08","epss":0.02994,"percentile":0.86944}],"risk":1.497,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11745"},"relatedVulnerabilities":[{"id":"CVE-2019-11745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11745","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11745","date":"2026-10-08","epss":0.02994,"percentile":0.86944}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html","https://access.redhat.com/errata/RHSA-2020:0243","https://access.redhat.com/errata/RHSA-2020:0466","https://bugzilla.mozilla.org/show_bug.cgi?id=1586176","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/202003-02","https://security.gentoo.org/glsa/202003-10","https://security.gentoo.org/glsa/202003-37","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","https://usn.ubuntu.com/4241-1/","https://usn.ubuntu.com/4335-1/","https://www.mozilla.org/security/advisories/mfsa2019-36/","https://www.mozilla.org/security/advisories/mfsa2019-37/","https://www.mozilla.org/security/advisories/mfsa2019-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11745","description":"When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-68w8-qjq3-2gfm","versionConstraint":"<2.2.24 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-68w8-qjq3-2gfm","fix":{"state":"fixed","versions":["2.2.24"],"available":[{"date":"2021-06-11","kind":"first-observed","version":"2.2.24"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33203","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33203","date":"2026-10-08","epss":0.02737,"percentile":0.8569}],"risk":1.491665,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33203","https://groups.google.com/forum/#!forum/django-announce","https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90","https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f","https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9","https://docs.djangoproject.com/en/3.2/releases/security","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-98.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV","https://security.netapp.com/advisory/ntap-20210727-0004","https://www.djangoproject.com/weblog/2021/jun/02/security-releases"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-68w8-qjq3-2gfm","description":"Path Traversal in Django"},"relatedVulnerabilities":[{"id":"CVE-2021-33203","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33203","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33203","date":"2026-10-08","epss":0.02737,"percentile":0.8569}],"urls":["https://docs.djangoproject.com/en/3.2/releases/security/","https://groups.google.com/forum/#%21forum/django-announce","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/","https://security.netapp.com/advisory/ntap-20210727-0004/","https://www.djangoproject.com/weblog/2021/jun/02/security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33203","description":"Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vqcj-wrf2-7v73","versionConstraint":"<8.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vqcj-wrf2-7v73","fix":{"state":"fixed","versions":["8.1.0"],"available":[{"date":"2021-03-19","kind":"first-observed","version":"8.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35654","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35654","date":"2026-10-08","epss":0.01817,"percentile":0.78061}],"risk":1.4717699999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35654","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73","description":"Pillow Out-of-bounds Write"},"relatedVulnerabilities":[{"id":"CVE-2020-35654","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35654","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35654","date":"2026-10-08","epss":0.01817,"percentile":0.78061}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/index.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35654","description":"In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode."}]},{"artifact":{"id":"07a48bc82f73df88","cpes":["cpe:2.3:a:cpp-4.9:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp-4.9:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"cpp-4.9","purl":"pkg:deb/debian/cpp-4.9@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/cpp-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/cpp-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/cpp-4.9.list"}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"f3d03a2b0daa9d87","cpes":["cpe:2.3:a:gcc-4.9:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"gcc-4.9","purl":"pkg:deb/debian/gcc-4.9@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/gcc-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/gcc-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/gcc-4.9.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"7a9c15c748e2912d","cpes":["cpe:2.3:a:gcc-4.9-base:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9-base:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"gcc-4.9-base","purl":"pkg:deb/debian/gcc-4.9-base@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/gcc-4.9-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"1295f532eee1bbcb","cpes":["cpe:2.3:a:libasan1:libasan1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libasan1","purl":"pkg:deb/debian/libasan1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libasan1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasan1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libasan1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"e9443dfb29ef37be","cpes":["cpe:2.3:a:libatomic1:libatomic1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"78ac2caf4292b56f","cpes":["cpe:2.3:a:libcilkrts5:libcilkrts5:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libcilkrts5","purl":"pkg:deb/debian/libcilkrts5@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libcilkrts5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"87cd9c22388a3135","cpes":["cpe:2.3:a:libgcc-4.9-dev:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9-dev:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgcc-4.9-dev","purl":"pkg:deb/debian/libgcc-4.9-dev@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgcc-4.9-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"be8d8bdc85d3899a","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/debian/libgcc1@1%3A4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9%404.9.2-10%2Bdeb8u2","type":"deb","version":"1:4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"b1f290ff6dd87d81","cpes":["cpe:2.3:a:libgomp1:libgomp1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/debian/libgomp1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"f1afdb73e328928f","cpes":["cpe:2.3:a:libitm1:libitm1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libitm1","purl":"pkg:deb/debian/libitm1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libitm1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libitm1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libitm1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"2212c93561570040","cpes":["cpe:2.3:a:liblsan0:liblsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"liblsan0","purl":"pkg:deb/debian/liblsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/liblsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"b7e137bbb6f5501a","cpes":["cpe:2.3:a:libquadmath0:libquadmath0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libquadmath0","purl":"pkg:deb/debian/libquadmath0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libquadmath0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"f1e71f056e2c280a","cpes":["cpe:2.3:a:libstdc\\+\\+-4.9-dev:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9-dev:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9_dev:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9_dev:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libstdc++-4.9-dev","purl":"pkg:deb/debian/libstdc%2B%2B-4.9-dev@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libstdc++-4.9-dev:amd64.md5sums","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/info/libstdc++-4.9-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libstdc++-4.9-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"a187af30638477ac","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"0db287b58c00302a","cpes":["cpe:2.3:a:libtsan0:libtsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libtsan0","purl":"pkg:deb/debian/libtsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libtsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"a9fcfb62cd9c9f1f","cpes":["cpe:2.3:a:libubsan0:libubsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libubsan0","purl":"pkg:deb/debian/libubsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libubsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-9318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9318","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9318"},"relatedVulnerabilities":[{"id":"CVE-2016-9318","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"urls":["http://www.securityfocus.com/bid/94347","https://bugzilla.gnome.org/show_bug.cgi?id=772726","https://github.com/lsh123/xmlsec/issues/43","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9318","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9318"},"relatedVulnerabilities":[{"id":"CVE-2016-9318","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"urls":["http://www.securityfocus.com/bid/94347","https://bugzilla.gnome.org/show_bug.cgi?id=772726","https://github.com/lsh123/xmlsec/issues/43","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qw25-v68c-qjf3","versionConstraint":"<4.2.26 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-qw25-v68c-qjf3","fix":{"state":"fixed","versions":["4.2.26"],"available":[{"date":"2025-11-06","kind":"first-observed","version":"4.2.26"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64458","cwe":"CWE-407","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64458","date":"2026-10-08","epss":0.01909,"percentile":0.79156}],"risk":1.43175,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64458","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases","https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242","https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac","https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f","https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qw25-v68c-qjf3","description":"Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows"},"relatedVulnerabilities":[{"id":"CVE-2025-64458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64458","cwe":"CWE-407","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64458","date":"2026-10-08","epss":0.01909,"percentile":0.79156}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64458","description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15938","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15938","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15938","date":"2026-10-08","epss":0.04726,"percentile":0.91606}],"risk":1.4178,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15938"},"relatedVulnerabilities":[{"id":"CVE-2017-15938","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15938","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15938","date":"2026-10-08","epss":0.04726,"percentile":0.91606}],"urls":["http://www.securityfocus.com/bid/101610","https://blogs.gentoo.org/ago/2017/10/24/binutils-invalid-memory-read-in-find_abstract_instance_name-dwarf2-c/","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=22209","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1b86808a86077722ee4f42ff97f836b12420bb2a"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15938","description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash)."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11729","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11729","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11729","date":"2026-10-08","epss":0.02794,"percentile":0.86015}],"risk":1.397,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11729"},"relatedVulnerabilities":[{"id":"CVE-2019-11729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11729","date":"2026-10-08","epss":0.02794,"percentile":0.86015}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","https://access.redhat.com/errata/RHSA-2019:1951","https://access.redhat.com/errata/RHSA-2019:4190","https://bugzilla.mozilla.org/show_bug.cgi?id=1515342","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/201908-12","https://security.gentoo.org/glsa/201908-20","https://www.mozilla.org/security/advisories/mfsa2019-21/","https://www.mozilla.org/security/advisories/mfsa2019-22/","https://www.mozilla.org/security/advisories/mfsa2019-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11729","description":"Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11729","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11729","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11729","date":"2026-10-08","epss":0.02794,"percentile":0.86015}],"risk":1.397,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11729"},"relatedVulnerabilities":[{"id":"CVE-2019-11729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11729","date":"2026-10-08","epss":0.02794,"percentile":0.86015}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","https://access.redhat.com/errata/RHSA-2019:1951","https://access.redhat.com/errata/RHSA-2019:4190","https://bugzilla.mozilla.org/show_bug.cgi?id=1515342","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/201908-12","https://security.gentoo.org/glsa/201908-20","https://www.mozilla.org/security/advisories/mfsa2019-21/","https://www.mozilla.org/security/advisories/mfsa2019-22/","https://www.mozilla.org/security/advisories/mfsa2019-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11729","description":"Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8."}]},{"artifact":{"id":"3dc7a0363d8f956c","cpes":["cpe:2.3:a:httplib2_project:httplib2:0.13.0:*:*:*:*:python:*:*","cpe:2.3:a:httplib2_project:httplib2:0.13.0:*:*:*:*:*:*:*"],"name":"httplib2","purl":"pkg:pypi/httplib2@0.13.0","type":"python","version":"0.13.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.13.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gg84-qgv9-w4pq","versionConstraint":"<0.18.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"httplib2","version":"0.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gg84-qgv9-w4pq","fix":{"state":"fixed","versions":["0.18.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"0.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11078","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11078","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11078","date":"2026-10-08","epss":0.02407,"percentile":0.83567}],"risk":1.3900425,"urls":["https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e","https://nvd.nist.gov/vuln/detail/CVE-2020-11078","https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html","https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E","https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2020-46.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gg84-qgv9-w4pq","description":"CRLF injection in httplib2"},"relatedVulnerabilities":[{"id":"CVE-2020-11078","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11078","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11078","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11078","date":"2026-10-08","epss":0.02407,"percentile":0.83567}],"urls":["https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e","https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6131","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-6131","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6131","date":"2026-10-08","epss":0.04619,"percentile":0.91452}],"risk":1.3857,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6131"},"relatedVulnerabilities":[{"id":"CVE-2016-6131","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6131","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6131","date":"2026-10-08","epss":0.04619,"percentile":0.91452}],"urls":["http://www.openwall.com/lists/oss-security/2016/06/30/4","http://www.openwall.com/lists/oss-security/2016/06/30/7","http://www.securityfocus.com/bid/91519","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71696","https://gcc.gnu.org/ml/gcc-patches/2016-06/msg02030.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6131","description":"The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-5130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5130","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"risk":1.3565,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5130"},"relatedVulnerabilities":[{"id":"CVE-2017-5130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"urls":["http://bugzilla.gnome.org/show_bug.cgi?id=783026","http://www.securityfocus.com/bid/101482","https://access.redhat.com/errata/RHSA-2017:2997","https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","https://crbug.com/722079","https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed","https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201710-24","https://security.netapp.com/advisory/ntap-20190719-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5130","description":"An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5130","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"risk":1.3565,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5130"},"relatedVulnerabilities":[{"id":"CVE-2017-5130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"urls":["http://bugzilla.gnome.org/show_bug.cgi?id=783026","http://www.securityfocus.com/bid/101482","https://access.redhat.com/errata/RHSA-2017:2997","https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","https://crbug.com/722079","https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed","https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201710-24","https://security.netapp.com/advisory/ntap-20190719-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5130","description":"An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file."}]},{"artifact":{"id":"9bb8f4339906ad80","cpes":["cpe:2.3:a:lxml:lxml:4.3.4:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@4.3.4","type":"python","version":"4.3.4","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-4.3.4.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.9.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wrxv-2j5q-m38w","versionConstraint":"<4.9.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"4.3.4"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wrxv-2j5q-m38w","fix":{"state":"fixed","versions":["4.9.1"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.9.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2309","cwe":"CWE-476","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2309","date":"2026-10-08","epss":0.02428,"percentile":0.83737}],"risk":1.34754,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-2309","https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://github.com/lxml/lxml/blob/master/CHANGES.txt","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","https://security.gentoo.org/glsa/202208-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","https://security.netapp.com/advisory/ntap-20220915-0006","https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w","description":"lxml NULL Pointer Dereference allows attackers to cause a denial of service"},"relatedVulnerabilities":[{"id":"CVE-2022-2309","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2309","cwe":"CWE-476","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2309","date":"2026-10-08","epss":0.02428,"percentile":0.83737}],"urls":["https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20220915-0006/","https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13710","date":"2026-10-08","epss":0.02674,"percentile":0.85346}],"risk":1.337,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13710"},"relatedVulnerabilities":[{"id":"CVE-2017-13710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13710","date":"2026-10-08","epss":0.02674,"percentile":0.85346}],"urls":["http://www.securityfocus.com/bid/100499","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0c54f69295208331faab9bc5e995111a35672f9b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13710","description":"The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.11"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.6.11||>= 3.7.0, < 3.7.7||>= 3.8.0, < 3.8.2||= 3.9.0-alpha1||= 3.9.0-alpha2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.6.11","3.7.7","3.8.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wqvq-5m8c-6g24","versionConstraint":"<1.25.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wqvq-5m8c-6g24","fix":{"state":"fixed","versions":["1.25.9"],"available":[{"date":"2021-06-19","kind":"first-observed","version":"1.25.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26137","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26137","date":"2026-10-08","epss":0.02269,"percentile":0.82516}],"risk":1.327365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-26137","https://github.com/urllib3/urllib3/pull/1800","https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml","https://usn.ubuntu.com/4570-1"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wqvq-5m8c-6g24","description":"CRLF injection in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2020-26137","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26137","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26137","date":"2026-10-08","epss":0.02269,"percentile":0.82516}],"urls":["https://bugs.python.org/issue39603","https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","https://github.com/urllib3/urllib3/pull/1800","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://usn.ubuntu.com/4570-1/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26137","description":"urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4517","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4517","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-4517","fix":{"state":"fixed","versions":["3.9.23","3.10.18","3.11.13","3.12.11","3.13.4","3.14.0b3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.23"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.18"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.4"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.0b3"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.23"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.18"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.14.0b3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":9.4,"impactScore":5.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4517","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4517","date":"2026-10-08","epss":0.0143,"percentile":0.72229}],"risk":1.3156,"urls":["https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f","https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da","https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9","https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a","https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e","https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a","https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a","https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01","https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1","https://github.com/python/cpython/issues/135034","https://github.com/python/cpython/pull/135037","https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4517","description":"Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=\"data\".\n\n\nYou are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of \"data\" or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.\n\nNote that for Python 3.14 or later the default value of filter= changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.8.20||>= 3.10.0a0, < 3.10.15||>= 3.11.0a0, < 3.11.10||>= 3.12.0a0, < 3.12.6||>= 3.13.0a0, < 3.13.0a1||>= 3.9.0a0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.8.20||>= 3.10.0a0, < 3.10.15||>= 3.11.0a0, < 3.11.10||>= 3.12.0a0, < 3.12.6||>= 3.13.0a0, < 3.13.0a1||>= 3.9.0a0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0a1"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0a1"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0a1"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"risk":1.2833,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"risk":1.2833,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"9d758eb3ff53db62","cpes":["cpe:2.3:a:pip_developers_project:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev_project:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_devproject:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa-dev:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa_dev:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:19.1.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@19.1.1","type":"python","version":"19.1.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/pip-19.1.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"21.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5xp3-jfq3-5q8x","versionConstraint":"<21.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"19.1.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-5xp3-jfq3-5q8x","fix":{"state":"fixed","versions":["21.1"],"available":[{"date":"2021-11-16","kind":"first-observed","version":"21.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3572","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-3572","date":"2026-10-08","epss":0.01829,"percentile":0.78207}],"risk":1.2711550000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3572","https://github.com/pypa/pip/pull/9827","https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b","https://access.redhat.com/errata/RHSA-2021:3254","https://bugzilla.redhat.com/show_bug.cgi?id=1962856","https://packetstormsecurity.com/files/162712/USN-4961-1.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20240621-0006","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2021-437.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5xp3-jfq3-5q8x","description":"Improper Input Validation in pip"},"relatedVulnerabilities":[{"id":"CVE-2021-3572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3572","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-3572","date":"2026-10-08","epss":0.01829,"percentile":0.78207}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1962856","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3572","description":"A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7227","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7227","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7227","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7227","date":"2026-10-08","epss":0.02497,"percentile":0.84208}],"risk":1.2485,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7227"},"relatedVulnerabilities":[{"id":"CVE-2017-7227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7227","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7227","date":"2026-10-08","epss":0.02497,"percentile":0.84208}],"urls":["http://www.securityfocus.com/bid/97209","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20906"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7227","description":"GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\\0' termination of a name field in ldlex.l."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f5g8-5qq7-938w","versionConstraint":">=0,<8.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-f5g8-5qq7-938w","fix":{"state":"fixed","versions":["8.1.0"],"available":[{"date":"2021-03-19","kind":"first-observed","version":"8.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35653","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35653","date":"2026-10-08","epss":0.0164,"percentile":0.75645}],"risk":1.2464000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35653","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5da5cda52e55bf","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-69.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f5g8-5qq7-938w","description":"Pillow Out-of-bounds Read"},"relatedVulnerabilities":[{"id":"CVE-2020-35653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35653","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35653","date":"2026-10-08","epss":0.0164,"percentile":0.75645}],"urls":["https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","https://pillow.readthedocs.io/en/stable/releasenotes/index.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35653","description":"In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7226","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7226","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7226","date":"2026-10-08","epss":0.02487,"percentile":0.84142}],"risk":1.2435,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7226"},"relatedVulnerabilities":[{"id":"CVE-2017-7226","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7226","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7226","date":"2026-10-08","epss":0.02487,"percentile":0.84142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=20905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7226","description":"The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7225","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7225","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7225","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7225","date":"2026-10-08","epss":0.02454,"percentile":0.83923}],"risk":1.2269999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7225"},"relatedVulnerabilities":[{"id":"CVE-2017-7225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7225","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7225","date":"2026-10-08","epss":0.02454,"percentile":0.83923}],"urls":["http://www.securityfocus.com/bid/97275","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20891"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7225","description":"The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9074","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9074","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9074","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9074","date":"2026-10-08","epss":0.0241,"percentile":0.83591}],"risk":1.205,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9074"},"relatedVulnerabilities":[{"id":"CVE-2016-9074","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9074","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9074","date":"2026-10-08","epss":0.0241,"percentile":0.83591}],"urls":["http://www.securityfocus.com/bid/94341","http://www.securitytracker.com/id/1037298","https://bugzilla.mozilla.org/show_bug.cgi?id=1293334","https://security.gentoo.org/glsa/201701-15","https://security.gentoo.org/glsa/201701-46","https://www.debian.org/security/2016/dsa-3730","https://www.mozilla.org/security/advisories/mfsa2016-89/","https://www.mozilla.org/security/advisories/mfsa2016-90/","https://www.mozilla.org/security/advisories/mfsa2016-93/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9074","description":"An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9074","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9074","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9074","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9074","date":"2026-10-08","epss":0.0241,"percentile":0.83591}],"risk":1.205,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9074"},"relatedVulnerabilities":[{"id":"CVE-2016-9074","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9074","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9074","date":"2026-10-08","epss":0.0241,"percentile":0.83591}],"urls":["http://www.securityfocus.com/bid/94341","http://www.securitytracker.com/id/1037298","https://bugzilla.mozilla.org/show_bug.cgi?id=1293334","https://security.gentoo.org/glsa/201701-15","https://security.gentoo.org/glsa/201701-46","https://www.debian.org/security/2016/dsa-3730","https://www.mozilla.org/security/advisories/mfsa2016-89/","https://www.mozilla.org/security/advisories/mfsa2016-90/","https://www.mozilla.org/security/advisories/mfsa2016-93/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9074","description":"An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7302","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7302","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7302","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7302","date":"2026-10-08","epss":0.02406,"percentile":0.83564}],"risk":1.203,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7302"},"relatedVulnerabilities":[{"id":"CVE-2017-7302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7302","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7302","date":"2026-10-08","epss":0.02406,"percentile":0.83564}],"urls":["http://www.securityfocus.com/bid/97216","https://sourceware.org/bugzilla/show_bug.cgi?id=20921"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7302","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":1.2018,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228"},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":1.2018,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228"},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":1.2018,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228"},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":1.2018,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228"},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":1.2018,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228"},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12133","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"risk":1.2015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12133"},"relatedVulnerabilities":[{"id":"CVE-2017-12133","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/","https://sourceware.org/bugzilla/show_bug.cgi?id=21115","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491","https://usn.ubuntu.com/4416-1/","https://www.securityfocus.com/bid/100679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12133","description":"Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12133","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"risk":1.2015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12133"},"relatedVulnerabilities":[{"id":"CVE-2017-12133","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/","https://sourceware.org/bugzilla/show_bug.cgi?id=21115","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491","https://usn.ubuntu.com/4416-1/","https://www.securityfocus.com/bid/100679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12133","description":"Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12133","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"risk":1.2015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12133"},"relatedVulnerabilities":[{"id":"CVE-2017-12133","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/","https://sourceware.org/bugzilla/show_bug.cgi?id=21115","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491","https://usn.ubuntu.com/4416-1/","https://www.securityfocus.com/bid/100679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12133","description":"Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12133","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"risk":1.2015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12133"},"relatedVulnerabilities":[{"id":"CVE-2017-12133","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/","https://sourceware.org/bugzilla/show_bug.cgi?id=21115","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491","https://usn.ubuntu.com/4416-1/","https://www.securityfocus.com/bid/100679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12133","description":"Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12133","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"risk":1.2015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12133"},"relatedVulnerabilities":[{"id":"CVE-2017-12133","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12133","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12133","date":"2026-10-08","epss":0.02403,"percentile":0.83537}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/","https://sourceware.org/bugzilla/show_bug.cgi?id=21115","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491","https://usn.ubuntu.com/4416-1/","https://www.securityfocus.com/bid/100679"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12133","description":"Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7300","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7300","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7300","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7300","date":"2026-10-08","epss":0.02396,"percentile":0.83495}],"risk":1.198,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7300"},"relatedVulnerabilities":[{"id":"CVE-2017-7300","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7300","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7300","date":"2026-10-08","epss":0.02396,"percentile":0.83495}],"urls":["http://www.securityfocus.com/bid/97219","https://sourceware.org/bugzilla/show_bug.cgi?id=20909"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7300","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7301","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7301","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7301","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7301","date":"2026-10-08","epss":0.02396,"percentile":0.83495}],"risk":1.198,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7301"},"relatedVulnerabilities":[{"id":"CVE-2017-7301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7301","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7301","date":"2026-10-08","epss":0.02396,"percentile":0.83495}],"urls":["http://www.securityfocus.com/bid/97218","https://sourceware.org/bugzilla/show_bug.cgi?id=20924"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7301","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-36632","versionConstraint":"<= 3.11.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-36632","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36632","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36632","date":"2026-10-08","epss":0.01584,"percentile":0.74824}],"risk":1.188,"urls":["https://docs.python.org/3/library/email.html","https://docs.python.org/3/library/email.utils.html","https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py","https://github.com/python/cpython/issues/103800"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.20||>= 3.11.0a1, < 3.11.15||>= 3.12.0a1, < 3.12.13||>= 3.13.0a1, < 3.13.11||>= 3.14.0a1, < 3.14.1||>= 3.15.0a1, < 3.15.0a3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.10.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-13836","versionConstraint":"< 3.10.20||>= 3.11.0a1, < 3.11.15||>= 3.12.0a1, < 3.12.13||>= 3.13.0a1, < 3.13.11||>= 3.14.0a1, < 3.14.1||>= 3.15.0a1, < 3.15.0a3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-13836","fix":{"state":"fixed","versions":["3.10.20","3.11.15","3.12.13","3.13.11","3.14.1","3.15.0a3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.10.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a3"},{"date":"2026-05-07","kind":"first-observed","version":"3.10.20"},{"date":"2026-05-07","kind":"first-observed","version":"3.11.15"},{"date":"2026-05-07","kind":"first-observed","version":"3.12.13"},{"date":"2025-12-10","kind":"first-observed","version":"3.13.11"},{"date":"2025-12-04","kind":"first-observed","version":"3.14.1"},{"date":"2026-04-15","kind":"first-observed","version":"3.15.0a3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13836","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13836","date":"2026-10-08","epss":0.01631,"percentile":0.75501}],"risk":1.17432,"urls":["https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628","https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15","https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155","https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5","https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0","https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c","https://github.com/python/cpython/issues/119451","https://github.com/python/cpython/pull/119454","https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","description":"When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbc8e569ed6f5bfc","cpes":["cpe:2.3:a:python:setuptools:41.0.1:*:*:*:*:*:*:*"],"name":"setuptools","purl":"pkg:pypi/setuptools@41.0.1","type":"python","version":"41.0.1","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","layerID":"sha256:5431d9fb366b850eedfc5a757ba628f3d9d1a6e2dff88d4274da775e82b80240","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-41.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"78.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5rjg-fvgr-3xxf","versionConstraint":"<78.1.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"setuptools","version":"41.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-5rjg-fvgr-3xxf","fix":{"state":"fixed","versions":["78.1.1"],"available":[{"date":"2025-05-22","kind":"first-observed","version":"78.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-10-08","epss":0.01539,"percentile":0.74138}],"risk":1.16964,"urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf","https://nvd.nist.gov/vuln/detail/CVE-2025-47273","https://github.com/pypa/setuptools/issues/4946","https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b","https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88","https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5rjg-fvgr-3xxf","description":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write"},"relatedVulnerabilities":[{"id":"CVE-2025-47273","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47273","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-47273","date":"2026-10-08","epss":0.01539,"percentile":0.74138}],"urls":["https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88","https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b","https://github.com/pypa/setuptools/issues/4946","https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf","https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7643","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7643","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7643","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7643","date":"2026-10-08","epss":0.02323,"percentile":0.82958}],"risk":1.1615,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7643"},"relatedVulnerabilities":[{"id":"CVE-2018-7643","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7643","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7643","date":"2026-10-08","epss":0.02323,"percentile":0.82958}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/103264","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22905"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7643","description":"The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8872","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8872","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8872","date":"2026-10-08","epss":0.02306,"percentile":0.82824}],"risk":1.153,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8872"},"relatedVulnerabilities":[{"id":"CVE-2017-8872","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8872","date":"2026-10-08","epss":0.02306,"percentile":0.82824}],"urls":["https://bugzilla.gnome.org/show_bug.cgi?id=775200","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8872","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8872","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8872","date":"2026-10-08","epss":0.02306,"percentile":0.82824}],"risk":1.153,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8872"},"relatedVulnerabilities":[{"id":"CVE-2017-8872","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8872","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8872","date":"2026-10-08","epss":0.02306,"percentile":0.82824}],"urls":["https://bugzilla.gnome.org/show_bug.cgi?id=775200","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-10372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10372","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10372","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10372","date":"2026-10-08","epss":0.02301,"percentile":0.8279}],"risk":1.1504999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10372"},"relatedVulnerabilities":[{"id":"CVE-2018-10372","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10372","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10372","date":"2026-10-08","epss":0.02301,"percentile":0.8279}],"urls":["http://www.securityfocus.com/bid/103976","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201908-01","https://sourceware.org/bugzilla/show_bug.cgi?id=23064","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10372","description":"process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11719","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11719","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11719","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11719","date":"2026-10-08","epss":0.02292,"percentile":0.82715}],"risk":1.146,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11719"},"relatedVulnerabilities":[{"id":"CVE-2019-11719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11719","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11719","date":"2026-10-08","epss":0.02292,"percentile":0.82715}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","https://access.redhat.com/errata/RHSA-2019:1951","https://bugzilla.mozilla.org/show_bug.cgi?id=1540541","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/201908-12","https://security.gentoo.org/glsa/201908-20","https://www.mozilla.org/security/advisories/mfsa2019-21/","https://www.mozilla.org/security/advisories/mfsa2019-22/","https://www.mozilla.org/security/advisories/mfsa2019-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11719","description":"When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11719","versionConstraint":"< 2:3.26-1+debu8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11719","fix":{"state":"fixed","versions":["2:3.26-1+debu8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-11719","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11719","date":"2026-10-08","epss":0.02292,"percentile":0.82715}],"risk":1.146,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11719"},"relatedVulnerabilities":[{"id":"CVE-2019-11719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11719","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11719","date":"2026-10-08","epss":0.02292,"percentile":0.82715}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","https://access.redhat.com/errata/RHSA-2019:1951","https://bugzilla.mozilla.org/show_bug.cgi?id=1540541","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://security.gentoo.org/glsa/201908-12","https://security.gentoo.org/glsa/201908-20","https://www.mozilla.org/security/advisories/mfsa2019-21/","https://www.mozilla.org/security/advisories/mfsa2019-22/","https://www.mozilla.org/security/advisories/mfsa2019-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11719","description":"When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6543","date":"2026-10-08","epss":0.02285,"percentile":0.82636}],"risk":1.1424999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6543"},"relatedVulnerabilities":[{"id":"CVE-2018-6543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6543","date":"2026-10-08","epss":0.02285,"percentile":0.82636}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/102985","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6543","description":"In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14729","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14729","date":"2026-10-08","epss":0.02264,"percentile":0.82471}],"risk":1.1320000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14729"},"relatedVulnerabilities":[{"id":"CVE-2017-14729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14729","date":"2026-10-08","epss":0.02264,"percentile":0.82471}],"urls":["https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22170","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=56933f9e3e90eebf1018ed7417d6c1184b91db6b","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14729","description":"The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c."}]},{"artifact":{"id":"ad4c40b38aa9a02a","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1354","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1354","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-10-08","epss":0.22598,"percentile":0.97668}],"risk":1.1299,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1354"},"relatedVulnerabilities":[{"id":"CVE-2019-1354","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-10-08","epss":0.22598,"percentile":0.97668}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1354","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387."}]},{"artifact":{"id":"5c35d511782318ab","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u7?arch=all&distro=debian-8.11&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1354","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1354","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-10-08","epss":0.22598,"percentile":0.97668}],"risk":1.1299,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1354"},"relatedVulnerabilities":[{"id":"CVE-2019-1354","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-10-08","epss":0.22598,"percentile":0.97668}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1354","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xrcv-f9gm-v42c","versionConstraint":"<9.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-xrcv-f9gm-v42c","fix":{"state":"fixed","versions":["9.0.0"],"available":[{"date":"2022-01-13","kind":"first-observed","version":"9.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22816","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22816","date":"2026-10-08","epss":0.0192,"percentile":0.79275}],"risk":1.1232,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22816","https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://www.debian.org/security/2022/dsa-5053","https://security.gentoo.org/glsa/202211-10","https://github.com/python-pillow/Pillow/pull/5920","https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c","description":"Out-of-bounds Read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-22816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22816","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22816","date":"2026-10-08","epss":0.0192,"percentile":0.79275}],"urls":["https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://security.gentoo.org/glsa/202211-10","https://www.debian.org/security/2022/dsa-5053"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816","description":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path."}]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.24.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r64q-w8jr-g9qp","versionConstraint":"<=1.24.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-r64q-w8jr-g9qp","fix":{"state":"fixed","versions":["1.24.3"],"available":[{"date":"2022-06-29","kind":"first-observed","version":"1.24.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11236","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11236","date":"2026-10-08","epss":0.02073,"percentile":0.80874}],"risk":1.1090549999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-11236","https://github.com/urllib3/urllib3/issues/1553","https://access.redhat.com/errata/RHSA-2019:2272","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-132.yaml","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2","https://usn.ubuntu.com/3990-1","https://usn.ubuntu.com/3990-2"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r64q-w8jr-g9qp","description":"Improper Neutralization of CRLF Sequences in urllib3 library for Python"},"relatedVulnerabilities":[{"id":"CVE-2019-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11236","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11236","date":"2026-10-08","epss":0.02073,"percentile":0.80874}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","https://access.redhat.com/errata/RHSA-2019:2272","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://github.com/urllib3/urllib3/issues/1553","https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/","https://usn.ubuntu.com/3990-1/","https://usn.ubuntu.com/3990-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11236","description":"In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7303","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7303","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7303","date":"2026-10-08","epss":0.02217,"percentile":0.82108}],"risk":1.1085,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7303"},"relatedVulnerabilities":[{"id":"CVE-2017-7303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7303","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7303","date":"2026-10-08","epss":0.02217,"percentile":0.82108}],"urls":["http://www.securityfocus.com/bid/97213","https://sourceware.org/bugzilla/show_bug.cgi?id=20922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7303","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7208","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7208","date":"2026-10-08","epss":0.02214,"percentile":0.82083}],"risk":1.107,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7208"},"relatedVulnerabilities":[{"id":"CVE-2018-7208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7208","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7208","date":"2026-10-08","epss":0.02214,"percentile":0.82083}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/103077","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22741"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7208","description":"In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6565-fg86-6jcx","versionConstraint":"<1.7.6 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-6565-fg86-6jcx","fix":{"state":"fixed","versions":["1.7.6"],"available":[{"date":"2023-08-05","kind":"first-observed","version":"1.7.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2241","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2241","date":"2026-10-08","epss":0.02069,"percentile":0.8083}],"risk":1.1069149999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-2241","https://code.djangoproject.com/ticket/24461","https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5","https://github.com/django/django/commit/82c9169077a066995e3b00aac551bf1c8a89d98a","https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109","https://web.archive.org/web/20171112005349/http://www.securityfocus.com/bid/73095","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-8.yaml","https://www.djangoproject.com/weblog/2015/mar/09/security-releases","http://www.mandriva.com/security/advisories?name=MDVSA-2015:109"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6565-fg86-6jcx","description":"Django Cross-site Scripting Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2015-2241","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2241","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2241","date":"2026-10-08","epss":0.02069,"percentile":0.8083}],"urls":["http://www.mandriva.com/security/advisories?name=MDVSA-2015:109","http://www.securityfocus.com/bid/73095","https://code.djangoproject.com/ticket/24461","https://www.djangoproject.com/weblog/2015/mar/09/security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2241","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7614","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7614","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7614","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7614","date":"2026-10-08","epss":0.03662,"percentile":0.89334}],"risk":1.0986,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7614"},"relatedVulnerabilities":[{"id":"CVE-2017-7614","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7614","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7614","date":"2026-10-08","epss":0.03662,"percentile":0.89334}],"urls":["https://blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/","https://security.gentoo.org/glsa/201709-02"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7614","description":"elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a \"member access within null pointer\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an \"int main() {return 0;}\" program."}]},{"artifact":{"id":"416e29c1d38cede0","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.24-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10208","versionConstraint":"< 9.4.24-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-10208","fix":{"state":"fixed","versions":["9.4.24-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.24-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10208","date":"2026-10-08","epss":0.02188,"percentile":0.81864}],"risk":1.094,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10208"},"relatedVulnerabilities":[{"id":"CVE-2019-10208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10208","date":"2026-10-08","epss":0.02188,"percentile":0.81864}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208","https://www.postgresql.org/about/news/1960/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10208","description":"A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function."}]},{"artifact":{"id":"08c55331dd85cf95","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.22-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.22-0%2Bdeb8u1?arch=amd64&distro=debian-8.11&upstream=postgresql-9.4","type":"deb","version":"9.4.22-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.24-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10208","versionConstraint":"< 9.4.24-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"postgresql-9.4","version":"9.4.22-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-10208","fix":{"state":"fixed","versions":["9.4.24-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.24-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10208","date":"2026-10-08","epss":0.02188,"percentile":0.81864}],"risk":1.094,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10208"},"relatedVulnerabilities":[{"id":"CVE-2019-10208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10208","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10208","date":"2026-10-08","epss":0.02188,"percentile":0.81864}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208","https://www.postgresql.org/about/news/1960/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10208","description":"A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvg9-xffr-p774","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-mvg9-xffr-p774","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2022-12-02","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25291","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25291","date":"2026-10-08","epss":0.01398,"percentile":0.71625}],"risk":1.09044,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25291","https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-37.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvg9-xffr-p774","description":"Out of bounds read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25291","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25291","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25291","date":"2026-10-08","epss":0.01398,"percentile":0.71625}],"urls":["https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25291","description":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"risk":1.0875000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000408"},"relatedVulnerabilities":[{"id":"CVE-2017-1000408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"urls":["http://seclists.org/oss-sec/2017/q4/385","http://www.openwall.com/lists/oss-security/2019/06/27/7","http://www.openwall.com/lists/oss-security/2019/06/28/1","http://www.openwall.com/lists/oss-security/2019/06/28/2","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000408","description":"A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"risk":1.0875000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000408"},"relatedVulnerabilities":[{"id":"CVE-2017-1000408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"urls":["http://seclists.org/oss-sec/2017/q4/385","http://www.openwall.com/lists/oss-security/2019/06/27/7","http://www.openwall.com/lists/oss-security/2019/06/28/1","http://www.openwall.com/lists/oss-security/2019/06/28/2","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000408","description":"A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"risk":1.0875000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000408"},"relatedVulnerabilities":[{"id":"CVE-2017-1000408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"urls":["http://seclists.org/oss-sec/2017/q4/385","http://www.openwall.com/lists/oss-security/2019/06/27/7","http://www.openwall.com/lists/oss-security/2019/06/28/1","http://www.openwall.com/lists/oss-security/2019/06/28/2","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000408","description":"A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"risk":1.0875000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000408"},"relatedVulnerabilities":[{"id":"CVE-2017-1000408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"urls":["http://seclists.org/oss-sec/2017/q4/385","http://www.openwall.com/lists/oss-security/2019/06/27/7","http://www.openwall.com/lists/oss-security/2019/06/28/1","http://www.openwall.com/lists/oss-security/2019/06/28/2","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000408","description":"A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"risk":1.0875000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000408"},"relatedVulnerabilities":[{"id":"CVE-2017-1000408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000408","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000408","date":"2026-10-08","epss":0.0145,"percentile":0.7258}],"urls":["http://seclists.org/oss-sec/2017/q4/385","http://www.openwall.com/lists/oss-security/2019/06/27/7","http://www.openwall.com/lists/oss-security/2019/06/28/1","http://www.openwall.com/lists/oss-security/2019/06/28/2","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000408","description":"A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"07a48bc82f73df88","cpes":["cpe:2.3:a:cpp-4.9:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp-4.9:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"cpp-4.9","purl":"pkg:deb/debian/cpp-4.9@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/cpp-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/cpp-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/cpp-4.9.list"}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"7f9b12daf7eead77","cpes":["cpe:2.3:a:gcc-4.8-base:gcc-4.8-base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.8-base:gcc_4.8_base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.8_base:gcc-4.8-base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.8_base:gcc_4.8_base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.8:gcc-4.8-base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.8:gcc_4.8_base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.8:gcc-4.8-base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.8:gcc_4.8_base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.8-base:4.8.4-1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.8_base:4.8.4-1:*:*:*:*:*:*:*"],"name":"gcc-4.8-base","purl":"pkg:deb/debian/gcc-4.8-base@4.8.4-1?arch=amd64&distro=debian-8.11&upstream=gcc-4.8","type":"deb","version":"4.8.4-1","language":"","licenses":["sha256:76cb6d093b8fb3314d7e6c210c01c73d793dbedc792f345dbc14a0aa1411bcb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.8-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/gcc-4.8-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.8-base:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/gcc-4.8-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.8","version":"4.8.4-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"f3d03a2b0daa9d87","cpes":["cpe:2.3:a:gcc-4.9:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"gcc-4.9","purl":"pkg:deb/debian/gcc-4.9@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/gcc-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/gcc-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/gcc-4.9.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"7a9c15c748e2912d","cpes":["cpe:2.3:a:gcc-4.9-base:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9-base:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9-base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9_base:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"gcc-4.9-base","purl":"pkg:deb/debian/gcc-4.9-base@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/gcc-4.9-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"1295f532eee1bbcb","cpes":["cpe:2.3:a:libasan1:libasan1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libasan1","purl":"pkg:deb/debian/libasan1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libasan1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasan1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libasan1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"e9443dfb29ef37be","cpes":["cpe:2.3:a:libatomic1:libatomic1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"78ac2caf4292b56f","cpes":["cpe:2.3:a:libcilkrts5:libcilkrts5:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libcilkrts5","purl":"pkg:deb/debian/libcilkrts5@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libcilkrts5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"87cd9c22388a3135","cpes":["cpe:2.3:a:libgcc-4.9-dev:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9-dev:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgcc-4.9-dev","purl":"pkg:deb/debian/libgcc-4.9-dev@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgcc-4.9-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"be8d8bdc85d3899a","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/debian/libgcc1@1%3A4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9%404.9.2-10%2Bdeb8u2","type":"deb","version":"1:4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"b1f290ff6dd87d81","cpes":["cpe:2.3:a:libgomp1:libgomp1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/debian/libgomp1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"f1afdb73e328928f","cpes":["cpe:2.3:a:libitm1:libitm1:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libitm1","purl":"pkg:deb/debian/libitm1@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libitm1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libitm1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libitm1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"2212c93561570040","cpes":["cpe:2.3:a:liblsan0:liblsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"liblsan0","purl":"pkg:deb/debian/liblsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/liblsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"b7e137bbb6f5501a","cpes":["cpe:2.3:a:libquadmath0:libquadmath0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libquadmath0","purl":"pkg:deb/debian/libquadmath0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libquadmath0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"f1e71f056e2c280a","cpes":["cpe:2.3:a:libstdc\\+\\+-4.9-dev:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9-dev:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9_dev:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9_dev:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+-4.9:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+_4.9:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+-4.9-dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+_4.9_dev:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libstdc++-4.9-dev","purl":"pkg:deb/debian/libstdc%2B%2B-4.9-dev@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libstdc++-4.9-dev:amd64.md5sums","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/info/libstdc++-4.9-dev:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libstdc++-4.9-dev/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"a187af30638477ac","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"0db287b58c00302a","cpes":["cpe:2.3:a:libtsan0:libtsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libtsan0","purl":"pkg:deb/debian/libtsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libtsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"a9fcfb62cd9c9f1f","cpes":["cpe:2.3:a:libubsan0:libubsan0:4.9.2-10\\+deb8u2:*:*:*:*:*:*:*"],"name":"libubsan0","purl":"pkg:deb/debian/libubsan0@4.9.2-10%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=gcc-4.9","type":"deb","version":"4.9.2-10+deb8u2","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libubsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"gcc-4.9","version":"4.9.2-10+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.0855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886"},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6872","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6872","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6872","date":"2026-10-08","epss":0.02167,"percentile":0.81703}],"risk":1.0835,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6872"},"relatedVulnerabilities":[{"id":"CVE-2018-6872","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6872","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6872","date":"2026-10-08","epss":0.02167,"percentile":0.81703}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/103103","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22788","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Ba=commit%3Bh=ef135d4314fd4c2d7da66b9d7b59af4a85b0f7e6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6872","description":"The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-10535","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10535","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10535","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10535","date":"2026-10-08","epss":0.02133,"percentile":0.81427}],"risk":1.0665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10535"},"relatedVulnerabilities":[{"id":"CVE-2018-10535","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10535","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10535","date":"2026-10-08","epss":0.02133,"percentile":0.81427}],"urls":["http://www.securityfocus.com/bid/104021","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201908-01","https://sourceware.org/bugzilla/show_bug.cgi?id=23113","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10535","description":"The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a \"SECTION\" type that has a \"0\" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy."}]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17007","versionConstraint":"< 2:3.26-1+debu8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17007","fix":{"state":"fixed","versions":["2:3.26-1+debu8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17007","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17007","date":"2026-10-08","epss":0.01399,"percentile":0.71642}],"risk":1.04925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17007"},"relatedVulnerabilities":[{"id":"CVE-2019-17007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17007","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17007","date":"2026-10-08","epss":0.01399,"percentile":0.71642}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1533216","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44_release_notes","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17007","description":"In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17007","versionConstraint":"< 2:3.26-1+debu8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17007","fix":{"state":"fixed","versions":["2:3.26-1+debu8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17007","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17007","date":"2026-10-08","epss":0.01399,"percentile":0.71642}],"risk":1.04925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17007"},"relatedVulnerabilities":[{"id":"CVE-2019-17007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17007","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17007","date":"2026-10-08","epss":0.01399,"percentile":0.71642}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1533216","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44_release_notes","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17007","description":"In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7304","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7304","date":"2026-10-08","epss":0.02095,"percentile":0.8108}],"risk":1.0475,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7304"},"relatedVulnerabilities":[{"id":"CVE-2017-7304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7304","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7304","date":"2026-10-08","epss":0.02095,"percentile":0.8108}],"urls":["http://www.securityfocus.com/bid/97215","https://sourceware.org/bugzilla/show_bug.cgi?id=20931"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7304","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6759","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6759","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6759","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6759","date":"2026-10-08","epss":0.02091,"percentile":0.81048}],"risk":1.0455,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6759"},"relatedVulnerabilities":[{"id":"CVE-2018-6759","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6759","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6759","date":"2026-10-08","epss":0.02091,"percentile":0.81048}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/103030","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22794"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6759","description":"The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4138","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4138","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-4138","fix":{"state":"fixed","versions":["3.9.23","3.10.18","3.11.13","3.12.11","3.13.4","3.14.0b3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.23"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.18"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.4"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.0b3"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.23"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.18"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.14.0b3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4138","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4138","date":"2026-10-08","epss":0.01385,"percentile":0.71386}],"risk":1.0387499999999998,"urls":["https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f","https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da","https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9","https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a","https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e","https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a","https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a","https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01","https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1","https://github.com/python/cpython/issues/135034","https://github.com/python/cpython/pull/135037","https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4138","description":"Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\n\n\nYou are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of \"data\" or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.\n\nNote that for Python 3.14 or later the default value of filter= changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8088","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8088","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8088","cwe":"CWE-835","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2024-8088","date":"2026-10-08","epss":0.01275,"percentile":0.69058}],"risk":1.0327499999999998,"urls":["https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1","https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6","https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e","https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814","https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4","https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64","https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a","https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7","https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932","https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea","https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db","https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798","https://github.com/python/cpython/issues/122905","https://github.com/python/cpython/issues/123270","https://github.com/python/cpython/pull/122906","https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/","http://www.openwall.com/lists/oss-security/2024/08/22/1","http://www.openwall.com/lists/oss-security/2024/08/22/4","http://www.openwall.com/lists/oss-security/2024/08/23/1","http://www.openwall.com/lists/oss-security/2024/08/23/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241011-0010/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8088","description":"There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"219d2718cef52c0e","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13057","versionConstraint":"< 2.4.40+dfsg-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13057","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-13057","date":"2026-10-08","epss":0.03423,"percentile":0.88581}],"risk":1.0269,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13057"},"relatedVulnerabilities":[{"id":"CVE-2019-13057","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-13057","date":"2026-10-08","epss":0.03423,"percentile":0.88581}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://seclists.org/fulldisclosure/2019/Dec/26","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","https://seclists.org/bugtraq/2019/Dec/23","https://security.netapp.com/advisory/ntap-20190822-0004/","https://support.apple.com/kb/HT210788","https://usn.ubuntu.com/4078-1/","https://usn.ubuntu.com/4078-2/","https://www.openldap.org/its/?findid=9038","https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)"}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7569","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7569","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7569","date":"2026-10-08","epss":0.02046,"percentile":0.80603}],"risk":1.023,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7569"},"relatedVulnerabilities":[{"id":"CVE-2018-7569","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7569","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7569","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7569","date":"2026-10-08","epss":0.02046,"percentile":0.80603}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22895"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7569","description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cqhg-xjhh-p8hf","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-cqhg-xjhh-p8hf","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10177","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10177","date":"2026-10-08","epss":0.0148,"percentile":0.73134}],"risk":1.0211999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10177","https://github.com/python-pillow/Pillow/pull/4503","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573","https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html","https://github.com/python-pillow/Pillow/issues/4750","https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405","https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7","https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6","https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c","https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44","https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9","https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650","https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b","https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd","https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca","https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2","https://usn.ubuntu.com/4430-2","https://usn.ubuntu.com/4430-1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cqhg-xjhh-p8hf","description":"Out-of-bounds reads in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-10177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10177","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10177","date":"2026-10-08","epss":0.0148,"percentile":0.73134}],"urls":["https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://github.com/python-pillow/Pillow/pull/4503","https://github.com/python-pillow/Pillow/pull/4538","https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://usn.ubuntu.com/4430-1/","https://usn.ubuntu.com/4430-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10177","description":"Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m2vv-5vj5-2hm7","versionConstraint":"<9.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-m2vv-5vj5-2hm7","fix":{"state":"fixed","versions":["9.2.0"],"available":[{"date":"2022-11-23","kind":"first-observed","version":"9.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45198","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-45198","date":"2026-10-08","epss":0.01296,"percentile":0.69503}],"risk":1.01088,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-45198","https://github.com/python-pillow/Pillow/pull/6402","https://bugs.gentoo.org/855683","https://cwe.mitre.org/data/definitions/409.html","https://github.com/python-pillow/Pillow/releases/tag/9.2.0","https://github.com/python-pillow/Pillow/pull/6402/commits/c9f1b35e981075110a23487a8d4a6cbb59a588ea","https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4","https://security.gentoo.org/glsa/202211-10","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42979.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m2vv-5vj5-2hm7","description":"Pillow vulnerable to Data Amplification attack."},"relatedVulnerabilities":[{"id":"CVE-2022-45198","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45198","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-45198","date":"2026-10-08","epss":0.01296,"percentile":0.69503}],"urls":["https://bugs.gentoo.org/855683","https://cwe.mitre.org/data/definitions/409.html","https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4","https://github.com/python-pillow/Pillow/pull/6402","https://github.com/python-pillow/Pillow/releases/tag/9.2.0","https://security.gentoo.org/glsa/202211-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45198","description":"Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification)."}]},{"artifact":{"id":"b59933de6d161955","cpes":["cpe:2.3:a:jose_padilla_project:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_project:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padillaproject:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padillaproject:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello_project:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello_project:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla_project:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:helloproject:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:helloproject:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padillaproject:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello_project:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:helloproject:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:jose_padilla:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:hello:pyjwt:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:1.5.3:*:*:*:*:*:*:*"],"name":"pyjwt","purl":"pkg:pypi/pyjwt@1.5.3","type":"python","version":"1.5.3","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/PyJWT-1.5.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ffqj-6fqr-9h24","versionConstraint":">=1.5.0,<2.4.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"1.5.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-ffqj-6fqr-9h24","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2022-05-25","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29217","cwe":"CWE-327","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-29217","date":"2026-10-08","epss":0.01355,"percentile":0.70783}],"risk":1.009475,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24","https://nvd.nist.gov/vuln/detail/CVE-2022-29217","https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc","https://github.com/jpadilla/pyjwt/releases/tag/2.4.0","https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2022-202.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ffqj-6fqr-9h24","description":"Key confusion through non-blocklisted public key formats"},"relatedVulnerabilities":[{"id":"CVE-2022-29217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29217","cwe":"CWE-327","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-29217","date":"2026-10-08","epss":0.01355,"percentile":0.70783}],"urls":["https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc","https://github.com/jpadilla/pyjwt/releases/tag/2.4.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/","https://www.vicarius.io/vsociety/posts/risky-algorithms-algorithm-confusion-in-pyjwt-cve-2022-29217"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29217","description":"PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7244","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7244","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7244","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7244","date":"2026-10-08","epss":0.01995,"percentile":0.80075}],"risk":0.9974999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7244"},"relatedVulnerabilities":[{"id":"CVE-2017-7244","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7244","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7244","date":"2026-10-08","epss":0.01995,"percentile":0.80075}],"urls":["http://www.securityfocus.com/bid/97067","https://access.redhat.com/errata/RHSA-2018:2486","https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcre32_xclass-pcre_xclass-c/","https://security.gentoo.org/glsa/201710-25"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7244","description":"The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12448","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12448","date":"2026-10-08","epss":0.0198,"percentile":0.79903}],"risk":0.9900000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12448"},"relatedVulnerabilities":[{"id":"CVE-2017-12448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12448","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12448","date":"2026-10-08","epss":0.0198,"percentile":0.79903}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21787"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12448","description":"The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vj42-xq3r-hr3r","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vj42-xq3r-hr3r","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10994","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10994","date":"2026-10-08","epss":0.01432,"percentile":0.72251}],"risk":0.9880799999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10994","https://github.com/python-pillow/Pillow/pull/4505","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e4","https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574575","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-79.yaml","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://pillow.readthedocs.io/en/stable/releasenotes","https://usn.ubuntu.com/4430-1","https://usn.ubuntu.com/4430-2"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vj42-xq3r-hr3r","description":"Out-of-bounds reads in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-10994","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10994","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10994","date":"2026-10-08","epss":0.01432,"percentile":0.72251}],"urls":["https://github.com/python-pillow/Pillow/commits/master/src/libImaging/","https://github.com/python-pillow/Pillow/pull/4505","https://github.com/python-pillow/Pillow/pull/4538","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://usn.ubuntu.com/4430-1/","https://usn.ubuntu.com/4430-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10994","description":"In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8398","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8398","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8398","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8398","date":"2026-10-08","epss":0.01968,"percentile":0.79778}],"risk":0.984,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8398"},"relatedVulnerabilities":[{"id":"CVE-2017-8398","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8398","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8398","date":"2026-10-08","epss":0.01968,"percentile":0.79778}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21438"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8398","description":"dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12132","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12132","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"risk":0.979,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12132"},"relatedVulnerabilities":[{"id":"CVE-2017-12132","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"urls":["http://www.securityfocus.com/bid/100598","https://access.redhat.com/errata/RHSA-2018:0805","https://arxiv.org/pdf/1205.4011.pdf","https://sourceware.org/bugzilla/show_bug.cgi?id=21361"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12132","description":"The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12132","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12132","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"risk":0.979,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12132"},"relatedVulnerabilities":[{"id":"CVE-2017-12132","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"urls":["http://www.securityfocus.com/bid/100598","https://access.redhat.com/errata/RHSA-2018:0805","https://arxiv.org/pdf/1205.4011.pdf","https://sourceware.org/bugzilla/show_bug.cgi?id=21361"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12132","description":"The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12132","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12132","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"risk":0.979,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12132"},"relatedVulnerabilities":[{"id":"CVE-2017-12132","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"urls":["http://www.securityfocus.com/bid/100598","https://access.redhat.com/errata/RHSA-2018:0805","https://arxiv.org/pdf/1205.4011.pdf","https://sourceware.org/bugzilla/show_bug.cgi?id=21361"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12132","description":"The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12132","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12132","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"risk":0.979,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12132"},"relatedVulnerabilities":[{"id":"CVE-2017-12132","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"urls":["http://www.securityfocus.com/bid/100598","https://access.redhat.com/errata/RHSA-2018:0805","https://arxiv.org/pdf/1205.4011.pdf","https://sourceware.org/bugzilla/show_bug.cgi?id=21361"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12132","description":"The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12132","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12132","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"risk":0.979,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12132"},"relatedVulnerabilities":[{"id":"CVE-2017-12132","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12132","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12132","date":"2026-10-08","epss":0.01958,"percentile":0.79696}],"urls":["http://www.securityfocus.com/bid/100598","https://access.redhat.com/errata/RHSA-2018:0805","https://arxiv.org/pdf/1205.4011.pdf","https://sourceware.org/bugzilla/show_bug.cgi?id=21361"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12132","description":"The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7223","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7223","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7223","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7223","date":"2026-10-08","epss":0.01956,"percentile":0.79671}],"risk":0.9780000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7223"},"relatedVulnerabilities":[{"id":"CVE-2017-7223","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7223","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7223","date":"2026-10-08","epss":0.01956,"percentile":0.79671}],"urls":["https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20898"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7223","description":"GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash."}]},{"artifact":{"id":"781b6047e02b9997","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u4?arch=amd64&distro=debian-8.11&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u4","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5827","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5827","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5827","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-5827","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5827","date":"2026-10-08","epss":0.01948,"percentile":0.79603}],"risk":0.9740000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5827"},"relatedVulnerabilities":[{"id":"CVE-2019-5827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5827","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-5827","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5827","date":"2026-10-08","epss":0.01948,"percentile":0.79603}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html","https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html","https://crbug.com/952406","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/","https://seclists.org/bugtraq/2019/Aug/19","https://security.gentoo.org/glsa/202003-16","https://usn.ubuntu.com/4205-1/","https://www.debian.org/security/2019/dsa-4500"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5827","description":"Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-7210","versionConstraint":"< 3.10.22||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.14||>= 3.14.0, < 3.14.6||>= 3.15.0a1, < 3.15.0b2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"fixed","versions":["3.10.22","3.11.16","3.12.14","3.13.14","3.14.6","3.15.0b2"],"available":[{"date":"2026-10-02","kind":"first-observed","version":"3.10.22"},{"date":"2026-09-15","kind":"first-observed","version":"3.11.16"},{"date":"2026-09-15","kind":"first-observed","version":"3.12.14"},{"date":"2026-06-18","kind":"first-observed","version":"3.13.14"},{"date":"2026-06-18","kind":"first-observed","version":"3.14.6"},{"date":"2026-06-05","kind":"first-observed","version":"3.15.0b2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-10-08","epss":0.01351,"percentile":0.70668}],"risk":0.97272,"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."},"relatedVulnerabilities":[]},{"artifact":{"id":"c25c971ed0bdfe08","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u5:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=expat","type":"deb","version":"2.1.0-6+deb8u5","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2013-0340","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"expat","version":"2.1.0-6+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2013-0340","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2013-0340","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-0340","date":"2026-10-08","epss":0.19433,"percentile":0.97303}],"risk":0.9716500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2013-0340"},"relatedVulnerabilities":[{"id":"CVE-2013-0340","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2013-0340","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-0340","date":"2026-10-08","epss":0.19433,"percentile":0.97303}],"urls":["http://openwall.com/lists/oss-security/2013/02/22/3","http://seclists.org/fulldisclosure/2021/Oct/61","http://seclists.org/fulldisclosure/2021/Oct/62","http://seclists.org/fulldisclosure/2021/Oct/63","http://seclists.org/fulldisclosure/2021/Sep/33","http://seclists.org/fulldisclosure/2021/Sep/34","http://seclists.org/fulldisclosure/2021/Sep/35","http://seclists.org/fulldisclosure/2021/Sep/38","http://seclists.org/fulldisclosure/2021/Sep/39","http://seclists.org/fulldisclosure/2021/Sep/40","http://securitytracker.com/id?1028213","http://www.openwall.com/lists/oss-security/2013/04/12/6","http://www.openwall.com/lists/oss-security/2021/10/07/4","http://www.osvdb.org/90634","http://www.securityfocus.com/bid/58233","https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes","https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E","https://security.gentoo.org/glsa/201701-21","https://support.apple.com/kb/HT212804","https://support.apple.com/kb/HT212805","https://support.apple.com/kb/HT212807","https://support.apple.com/kb/HT212814","https://support.apple.com/kb/HT212815","https://support.apple.com/kb/HT212819"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7568","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7568","date":"2026-10-08","epss":0.01925,"percentile":0.79323}],"risk":0.9625,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7568"},"relatedVulnerabilities":[{"id":"CVE-2018-7568","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7568","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7568","date":"2026-10-08","epss":0.01925,"percentile":0.79323}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22894"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7568","description":"The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm."}]},{"artifact":{"id":"b35d094cb991c1d8","cpes":["cpe:2.3:a:python:urllib3:1.22:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.22","type":"python","version":"1.22","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.22.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.26.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v845-jxx5-vc9f","versionConstraint":"<1.26.17 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.22"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-v845-jxx5-vc9f","fix":{"state":"fixed","versions":["1.26.17"],"available":[{"date":"2023-10-03","kind":"first-observed","version":"1.26.17"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-43804","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-43804","date":"2026-10-08","epss":0.0136,"percentile":0.70903}],"risk":0.9622,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f","https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb","https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d","https://nvd.nist.gov/vuln/detail/CVE-2023-43804","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ","https://security.netapp.com/advisory/ntap-20241213-0007","https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v845-jxx5-vc9f","description":"`Cookie` HTTP header isn't stripped on cross-origin redirects"},"relatedVulnerabilities":[{"id":"CVE-2023-43804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-43804","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-43804","date":"2026-10-08","epss":0.0136,"percentile":0.70903}],"urls":["https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb","https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d","https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ/","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://security.netapp.com/advisory/ntap-20241213-0007/","https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804","description":"urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5."}]},{"artifact":{"id":"b8ecf169f06de613","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u15:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u15?arch=amd64&distro=debian-8.11&upstream=curl","type":"deb","version":"7.38.0-4+deb8u15","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"curl","version":"7.38.0-4+deb8u15"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-8177","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8177","cwe":"CWE-99","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8177","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8177","date":"2026-10-08","epss":0.01251,"percentile":0.68522}],"risk":0.9570150000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8177"},"relatedVulnerabilities":[{"id":"CVE-2020-8177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8177","cwe":"CWE-99","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8177","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8177","date":"2026-10-08","epss":0.01251,"percentile":0.68522}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8177.html","https://hackerone.com/reports/887462","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8395","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8395","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8395","date":"2026-10-08","epss":0.01914,"percentile":0.7921}],"risk":0.9570000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8395"},"relatedVulnerabilities":[{"id":"CVE-2017-8395","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8395","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8395","date":"2026-10-08","epss":0.01914,"percentile":0.7921}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21431"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8395","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fp6p-5xvw-m74f","versionConstraint":"<1.8.10 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-fp6p-5xvw-m74f","fix":{"state":"fixed","versions":["1.8.10"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2513","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2513","date":"2026-10-08","epss":0.03345,"percentile":0.88335}],"risk":0.9533250000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-2513","https://github.com/django/django/commit/67b46ba7016da2d259c1ecc7d666d11f5e1cfaab","http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://web.archive.org/web/20160322001143/http://www.securitytracker.com/id/1035152","https://web.archive.org/web/20200228001222/http://www.securityfocus.com/bid/83878","https://github.com/django/django/commit/af7d09b0c5c6ab68e629fd9baf736f9dd203b18e","https://github.com/django/django/commit/f4e6e02f7713a6924d16540be279909ff4091eb6","https://www.djangoproject.com/weblog/2016/mar/01/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-16.yaml"],"severity":"Low","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fp6p-5xvw-m74f","description":"Django User Enumeration Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2016-2513","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2513","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2513","date":"2026-10-08","epss":0.03345,"percentile":0.88335}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/bid/83878","http://www.securitytracker.com/id/1035152","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://github.com/django/django/commit/67b46ba7016da2d259c1ecc7d666d11f5e1cfaab","https://www.djangoproject.com/weblog/2016/mar/01/security-releases/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2513","description":"The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8397","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8397","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8397","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8397","date":"2026-10-08","epss":0.01906,"percentile":0.79118}],"risk":0.9530000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8397"},"relatedVulnerabilities":[{"id":"CVE-2017-8397","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8397","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8397","date":"2026-10-08","epss":0.01906,"percentile":0.79118}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21434"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8397","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48564","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.7||>= 3.9.0, < 3.9.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48564","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.7","3.9.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48564","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48564","date":"2026-10-08","epss":0.01651,"percentile":0.75804}],"risk":0.949325,"urls":["https://bugs.python.org/issue42103","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://security.netapp.com/advisory/ntap-20230929-0009/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48564","description":"read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12459","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12459","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12459","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12459","date":"2026-10-08","epss":0.01892,"percentile":0.7896}],"risk":0.946,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12459"},"relatedVulnerabilities":[{"id":"CVE-2017-12459","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12459","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12459","date":"2026-10-08","epss":0.01892,"percentile":0.7896}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21840"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12459","description":"The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8393","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8393","date":"2026-10-08","epss":0.0189,"percentile":0.7894}],"risk":0.9450000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8393"},"relatedVulnerabilities":[{"id":"CVE-2017-8393","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8393","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8393","date":"2026-10-08","epss":0.0189,"percentile":0.7894}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21412"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8393","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12450","date":"2026-10-08","epss":0.01883,"percentile":0.7885}],"risk":0.9415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12450"},"relatedVulnerabilities":[{"id":"CVE-2017-12450","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12450","date":"2026-10-08","epss":0.01883,"percentile":0.7885}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21813"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12450","description":"The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7642","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7642","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7642","date":"2026-10-08","epss":0.01882,"percentile":0.7884}],"risk":0.941,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7642"},"relatedVulnerabilities":[{"id":"CVE-2018-7642","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7642","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7642","date":"2026-10-08","epss":0.01882,"percentile":0.7884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22887","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=116acb2c268c89c89186673a7c92620d21825b25"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7642","description":"The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.2.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wvqv-fj8w-qmhm","versionConstraint":"<5.2.17 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wvqv-fj8w-qmhm","fix":{"state":"fixed","versions":["5.2.17"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"5.2.17"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15307","cwe":"CWE-73","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"cve":"CVE-2026-15307","cwe":"CWE-918","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2026-15307","date":"2026-10-08","epss":0.01134,"percentile":0.65479}],"risk":0.9213749999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-15307","https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e","https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa","https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6","https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/aug/04/security-releases"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wvqv-fj8w-qmhm","description":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-15307","cvss":[{"type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15307","cwe":"CWE-73","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"cve":"CVE-2026-15307","cwe":"CWE-918","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2026-15307","date":"2026-10-08","epss":0.01134,"percentile":0.65479}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e","https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa","https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6","https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15307","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8394","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8394","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8394","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8394","date":"2026-10-08","epss":0.01839,"percentile":0.78323}],"risk":0.9195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8394"},"relatedVulnerabilities":[{"id":"CVE-2017-8394","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8394","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8394","date":"2026-10-08","epss":0.01839,"percentile":0.78323}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21414"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8394","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8396","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8396","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8396","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8396","date":"2026-10-08","epss":0.01839,"percentile":0.78323}],"risk":0.9195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8396"},"relatedVulnerabilities":[{"id":"CVE-2017-8396","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8396","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8396","date":"2026-10-08","epss":0.01839,"percentile":0.78323}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21432"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8396","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9755","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9755","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9755","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9755","date":"2026-10-08","epss":0.03048,"percentile":0.87157}],"risk":0.9143999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9755"},"relatedVulnerabilities":[{"id":"CVE-2017-9755","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9755","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9755","date":"2026-10-08","epss":0.03048,"percentile":0.87157}],"urls":["http://www.securityfocus.com/bid/99124","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21594"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9755","description":"opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9751","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9751","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9751","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9751","date":"2026-10-08","epss":0.03048,"percentile":0.87156}],"risk":0.9143999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9751"},"relatedVulnerabilities":[{"id":"CVE-2017-9751","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9751","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9751","date":"2026-10-08","epss":0.03048,"percentile":0.87156}],"urls":["http://www.securityfocus.com/bid/99111","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9751","description":"opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.18"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3426","versionConstraint":"< 2.7.18||>= 3.6.0, < 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.8||>= 3.9.0, < 3.9.3||= 3.10.0-alpha1||= 3.10.0-alpha2||= 3.10.0-alpha3||= 3.10.0-alpha4||= 3.10.0-alpha5||= 3.10.0-alpha6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-3426","fix":{"state":"fixed","versions":["2.7.18","3.6.13","3.7.10","3.8.8","3.9.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.18"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":2.9,"exploitabilityScore":5.2},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3426","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3426","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3426","date":"2026-10-08","epss":0.01878,"percentile":0.78795}],"risk":0.91083,"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1935913","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210629-0003/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3426","description":"There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7."},"relatedVulnerabilities":[]},{"artifact":{"id":"5c3fa81717523218","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-11727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11727","date":"2026-10-08","epss":0.01812,"percentile":0.77986}],"risk":0.906,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11727"},"relatedVulnerabilities":[{"id":"CVE-2019-11727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11727","date":"2026-10-08","epss":0.01812,"percentile":0.77986}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html","https://access.redhat.com/errata/RHSA-2019:1951","https://bugzilla.mozilla.org/show_bug.cgi?id=1552208","https://security.gentoo.org/glsa/201908-12","https://www.mozilla.org/security/advisories/mfsa2019-21/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11727","description":"A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68."}]},{"artifact":{"id":"4282f2c3e857bef6","cpes":["cpe:2.3:a:libnss3-dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_dev:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_dev:2\\:3.26-1\\+debu8u4:*:*:*:*:*:*:*"],"name":"libnss3-dev","purl":"pkg:deb/debian/libnss3-dev@2%3A3.26-1%2Bdebu8u4?arch=amd64&distro=debian-8.11&upstream=nss","type":"deb","version":"2:3.26-1+debu8u4","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libnss3-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libnss3-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"nss","version":"2:3.26-1+debu8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-11727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11727","date":"2026-10-08","epss":0.01812,"percentile":0.77986}],"risk":0.906,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11727"},"relatedVulnerabilities":[{"id":"CVE-2019-11727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11727","date":"2026-10-08","epss":0.01812,"percentile":0.77986}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html","https://access.redhat.com/errata/RHSA-2019:1951","https://bugzilla.mozilla.org/show_bug.cgi?id=1552208","https://security.gentoo.org/glsa/201908-12","https://www.mozilla.org/security/advisories/mfsa2019-21/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11727","description":"A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68."}]},{"artifact":{"id":"a284d36292d34bb5","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"2c66ac55e59f687c","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"2bb02c4c2bc9c746","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"498487d330ddcae4","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"0a7e397d74eef190","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"467f832be225b5af","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"8e2f25b73814be4b","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"5c4c26abee9f8bd7","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"9af78a81e5684683","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u5:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u5?arch=amd64&distro=debian-8.11&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u5","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"risk":0.8975000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5710"},"relatedVulnerabilities":[{"id":"CVE-2018-5710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5710","date":"2026-10-08","epss":0.01795,"percentile":0.77767}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5710","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function \"strlen\" is getting a \"NULL\" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15670","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15670","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"risk":0.8931,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15670"},"relatedVulnerabilities":[{"id":"CVE-2017-15670","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"urls":["http://www.securityfocus.com/bid/101521","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22320"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15670","description":"The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15670","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15670","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"risk":0.8931,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15670"},"relatedVulnerabilities":[{"id":"CVE-2017-15670","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"urls":["http://www.securityfocus.com/bid/101521","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22320"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15670","description":"The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15670","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15670","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"risk":0.8931,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15670"},"relatedVulnerabilities":[{"id":"CVE-2017-15670","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"urls":["http://www.securityfocus.com/bid/101521","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22320"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15670","description":"The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15670","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15670","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"risk":0.8931,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15670"},"relatedVulnerabilities":[{"id":"CVE-2017-15670","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"urls":["http://www.securityfocus.com/bid/101521","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22320"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15670","description":"The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15670","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15670","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"risk":0.8931,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15670"},"relatedVulnerabilities":[{"id":"CVE-2017-15670","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15670","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15670","date":"2026-10-08","epss":0.02977,"percentile":0.86867}],"urls":["http://www.securityfocus.com/bid/101521","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22320"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15670","description":"The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-10534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10534","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10534","date":"2026-10-08","epss":0.01784,"percentile":0.77625}],"risk":0.8920000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10534"},"relatedVulnerabilities":[{"id":"CVE-2018-10534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10534","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10534","date":"2026-10-08","epss":0.01784,"percentile":0.77625}],"urls":["http://www.securityfocus.com/bid/104025","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201908-01","https://sourceware.org/bugzilla/show_bug.cgi?id=23110","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10534","description":"The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8843-m7mw-mxqm","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8843-m7mw-mxqm","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10379","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10379","date":"2026-10-08","epss":0.01129,"percentile":0.65368}],"risk":0.8890874999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10379","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577","https://github.com/python-pillow/Pillow/issues/4750","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://usn.ubuntu.com/4430-2"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8843-m7mw-mxqm","description":"Buffer overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-10379","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10379","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10379","date":"2026-10-08","epss":0.01129,"percentile":0.65368}],"urls":["https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://github.com/python-pillow/Pillow/pull/4538","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://usn.ubuntu.com/4430-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8ghj-p4vj-mr35","versionConstraint":">=0,<10.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8ghj-p4vj-mr35","fix":{"state":"fixed","versions":["10.0.0"],"available":[{"date":"2023-11-04","kind":"first-observed","version":"10.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44271","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-44271","date":"2026-10-08","epss":0.01131,"percentile":0.65421}],"risk":0.8821800000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-44271","https://github.com/python-pillow/Pillow/pull/7244","https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml","https://devhub.checkmarx.com/cve-details/CVE-2023-44271","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8ghj-p4vj-mr35","description":"Pillow Denial of Service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2023-44271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44271","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-44271","date":"2026-10-08","epss":0.01131,"percentile":0.65421}],"urls":["https://devhub.checkmarx.com/cve-details/CVE-2023-44271/","https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7","https://github.com/python-pillow/Pillow/pull/7244","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271","description":"An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.9.22||>= 3.10.0, < 3.10.17||>= 3.11.0, < 3.11.12||>= 3.12.0, < 3.12.9||>= 3.13.0, < 3.13.2||>= 3.14.0a1, < 3.14.0a5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.22"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-0938","versionConstraint":"< 3.9.22||>= 3.10.0, < 3.10.17||>= 3.11.0, < 3.11.12||>= 3.12.0, < 3.12.9||>= 3.13.0, < 3.13.2||>= 3.14.0a1, < 3.14.0a5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-0938","fix":{"state":"fixed","versions":["3.9.22","3.10.17","3.11.12","3.12.9","3.13.2","3.14.0a5"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.22"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.17"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.12"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.9"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.2"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.0a5"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.22"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.12"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.2"},{"date":"2025-09-04","kind":"first-observed","version":"3.14.0a5"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0938","cwe":"CWE-20","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-0938","date":"2026-10-08","epss":0.01556,"percentile":0.74418}],"risk":0.8791399999999999,"urls":["https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba","https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403","https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568","https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab","https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a","https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32","https://github.com/python/cpython/issues/105704","https://github.com/python/cpython/pull/129418","https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://security.netapp.com/advisory/ntap-20250314-0002/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0938","description":"The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."},"relatedVulnerabilities":[]},{"artifact":{"id":"aebc716b731a9dc5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.7","type":"python","version":"2.7","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"42.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3ww4-gg4f-jr7f","versionConstraint":"<42.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.7"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3ww4-gg4f-jr7f","fix":{"state":"fixed","versions":["42.0.0"],"available":[{"date":"2024-02-06","kind":"first-observed","version":"42.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50782","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-50782","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-50782","date":"2026-10-08","epss":0.01118,"percentile":0.65112}],"risk":0.8720400000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-50782","https://access.redhat.com/security/cve/CVE-2023-50782","https://bugzilla.redhat.com/show_bug.cgi?id=2254432","https://github.com/pyca/cryptography/issues/9785","https://www.couchbase.com/alerts"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3ww4-gg4f-jr7f","description":"Python Cryptography package vulnerable to Bleichenbacher timing oracle attack"},"relatedVulnerabilities":[{"id":"CVE-2023-50782","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50782","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-50782","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-50782","date":"2026-10-08","epss":0.01118,"percentile":0.65112}],"urls":["https://access.redhat.com/security/cve/CVE-2023-50782","https://bugzilla.redhat.com/show_bug.cgi?id=2254432","https://www.couchbase.com/alerts/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50782","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"risk":0.8402999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15804"},"relatedVulnerabilities":[{"id":"CVE-2017-15804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"urls":["http://www.securityfocus.com/bid/101535","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22332","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15804","description":"The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"risk":0.8402999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15804"},"relatedVulnerabilities":[{"id":"CVE-2017-15804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"urls":["http://www.securityfocus.com/bid/101535","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22332","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15804","description":"The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"risk":0.8402999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15804"},"relatedVulnerabilities":[{"id":"CVE-2017-15804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"urls":["http://www.securityfocus.com/bid/101535","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22332","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15804","description":"The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"risk":0.8402999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15804"},"relatedVulnerabilities":[{"id":"CVE-2017-15804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"urls":["http://www.securityfocus.com/bid/101535","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22332","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15804","description":"The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"risk":0.8402999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15804"},"relatedVulnerabilities":[{"id":"CVE-2017-15804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15804","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15804","date":"2026-10-08","epss":0.02801,"percentile":0.86056}],"urls":["http://www.securityfocus.com/bid/101535","https://access.redhat.com/errata/RHSA-2018:0805","https://access.redhat.com/errata/RHSA-2018:1879","https://sourceware.org/bugzilla/show_bug.cgi?id=22332","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15804","description":"The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9743","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9743","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9743","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9743","date":"2026-10-08","epss":0.02795,"percentile":0.86021}],"risk":0.8385,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9743"},"relatedVulnerabilities":[{"id":"CVE-2017-9743","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9743","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9743","date":"2026-10-08","epss":0.02795,"percentile":0.86021}],"urls":["http://www.securityfocus.com/bid/99106","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21577"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9743","description":"The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9744","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9744","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9744","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9744","date":"2026-10-08","epss":0.0276,"percentile":0.85845}],"risk":0.828,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9744"},"relatedVulnerabilities":[{"id":"CVE-2017-9744","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9744","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9744","date":"2026-10-08","epss":0.0276,"percentile":0.85845}],"urls":["http://www.securityfocus.com/bid/99108","https://sourceware.org/bugzilla/show_bug.cgi?id=21578"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9744","description":"The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9753","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9753","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9753","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9753","date":"2026-10-08","epss":0.0276,"percentile":0.85845}],"risk":0.828,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9753"},"relatedVulnerabilities":[{"id":"CVE-2017-9753","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9753","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9753","date":"2026-10-08","epss":0.0276,"percentile":0.85845}],"urls":["http://www.securityfocus.com/bid/99116","https://sourceware.org/bugzilla/show_bug.cgi?id=21591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9753","description":"The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9752","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9752","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9752","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9752","date":"2026-10-08","epss":0.0276,"percentile":0.85844}],"risk":0.828,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9752"},"relatedVulnerabilities":[{"id":"CVE-2017-9752","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9752","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9752","date":"2026-10-08","epss":0.0276,"percentile":0.85844}],"urls":["http://www.securityfocus.com/bid/99122","https://sourceware.org/bugzilla/show_bug.cgi?id=21589"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9752","description":"bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9754","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9754","date":"2026-10-08","epss":0.02734,"percentile":0.85673}],"risk":0.8201999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9754"},"relatedVulnerabilities":[{"id":"CVE-2017-9754","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9754","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9754","date":"2026-10-08","epss":0.02734,"percentile":0.85673}],"urls":["http://www.securityfocus.com/bid/99125","https://sourceware.org/bugzilla/show_bug.cgi?id=21591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9754","description":"The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-4032","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.4||>= 3.13.0a1, < 3.13.0a6||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-4032","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.4||>= 3.13.0a1, < 3.13.0a6||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-4032","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.4","3.13.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.4"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0a6"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0a6"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4032","cwe":"CWE-697","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-4032","date":"2026-10-08","epss":0.01079,"percentile":0.64036}],"risk":0.8092499999999999,"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/3","https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8","https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f","https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3","https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb","https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906","https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3","https://github.com/python/cpython/issues/113171","https://github.com/python/cpython/pull/113179","https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/","https://security.netapp.com/advisory/ntap-20240726-0004/","https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml","https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4032","description":"The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior."},"relatedVulnerabilities":[]},{"artifact":{"id":"f82d1483ece80697","cpes":["cpe:2.3:a:kjd:internationalized_domain_names_in_applications:2.6:*:*:*:*:python:*:*"],"name":"idna","purl":"pkg:pypi/idna@2.6","type":"python","version":"2.6","language":"python","licenses":["BSD-like"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/idna-2.6.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjg7-2v4v-x38h","versionConstraint":"<3.7 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"idna","version":"2.6"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-jjg7-2v4v-x38h","fix":{"state":"fixed","versions":["3.7"],"available":[{"date":"2024-04-12","kind":"first-observed","version":"3.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3651","cwe":"CWE-1333","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-3651","date":"2026-10-08","epss":0.01386,"percentile":0.71393}],"risk":0.800415,"urls":["https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h","https://nvd.nist.gov/vuln/detail/CVE-2024-3651","https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d","https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml","https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjg7-2v4v-x38h","description":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode"},"relatedVulnerabilities":[{"id":"CVE-2024-3651","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3651","cwe":"CWE-1333","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-3651","date":"2026-10-08","epss":0.01386,"percentile":0.71393}],"urls":["https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d","https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651","description":"A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3xv8-3j54-hgrp","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3xv8-3j54-hgrp","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2021-11-04","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10378","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10378","date":"2026-10-08","epss":0.01114,"percentile":0.65013}],"risk":0.7992950000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10378","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac","https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://github.com/python-pillow/Pillow/issues/4750","https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://usn.ubuntu.com/4430-1","https://usn.ubuntu.com/4430-2","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3xv8-3j54-hgrp","description":"Out-of-bounds read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-10378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10378","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10378","date":"2026-10-08","epss":0.01114,"percentile":0.65013}],"urls":["https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac","https://github.com/python-pillow/Pillow/commits/master/src/libImaging","https://github.com/python-pillow/Pillow/pull/4538","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://usn.ubuntu.com/4430-1/","https://usn.ubuntu.com/4430-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10378","description":"In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9745","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9745","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9745","date":"2026-10-08","epss":0.02652,"percentile":0.85205}],"risk":0.7956,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9745"},"relatedVulnerabilities":[{"id":"CVE-2017-9745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9745","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9745","date":"2026-10-08","epss":0.02652,"percentile":0.85205}],"urls":["http://www.securityfocus.com/bid/99109","https://sourceware.org/bugzilla/show_bug.cgi?id=21579"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9745","description":"The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"ecdd3150e7520f1e","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-5969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5969","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5969","date":"2026-10-08","epss":0.0263,"percentile":0.85065}],"risk":0.7889999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5969"},"relatedVulnerabilities":[{"id":"CVE-2017-5969","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5969","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5969","date":"2026-10-08","epss":0.0263,"percentile":0.85065}],"urls":["http://www.openwall.com/lists/oss-security/2016/11/05/3","http://www.openwall.com/lists/oss-security/2017/02/13/1","http://www.securityfocus.com/bid/96188","https://bugzilla.gnome.org/show_bug.cgi?id=778519","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5969","description":"libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states \"I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."}]},{"artifact":{"id":"43f2dad6a26a89f7","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u7:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u7?arch=amd64&distro=debian-8.11&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u7","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5969","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5969","date":"2026-10-08","epss":0.0263,"percentile":0.85065}],"risk":0.7889999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5969"},"relatedVulnerabilities":[{"id":"CVE-2017-5969","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5969","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5969","date":"2026-10-08","epss":0.0263,"percentile":0.85065}],"urls":["http://www.openwall.com/lists/oss-security/2016/11/05/3","http://www.openwall.com/lists/oss-security/2017/02/13/1","http://www.securityfocus.com/bid/96188","https://bugzilla.gnome.org/show_bug.cgi?id=778519","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5969","description":"libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states \"I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9954","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9954","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9954","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9954","date":"2026-10-08","epss":0.01561,"percentile":0.74499}],"risk":0.7805000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9954"},"relatedVulnerabilities":[{"id":"CVE-2017-9954","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9954","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9954","date":"2026-10-08","epss":0.01561,"percentile":0.74499}],"urls":["http://www.securityfocus.com/bid/99307","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9954","description":"The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program."}]},{"artifact":{"id":"aebc716b731a9dc5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.7:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.7","type":"python","version":"2.7","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.7.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"39.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w7pp-m8wf-vj6r","versionConstraint":">=1.8,<39.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.7"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-w7pp-m8wf-vj6r","fix":{"state":"fixed","versions":["39.0.1"],"available":[{"date":"2023-02-09","kind":"first-observed","version":"39.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23931","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-23931","date":"2026-10-08","epss":0.01301,"percentile":0.69604}],"risk":0.761085,"urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r","https://nvd.nist.gov/vuln/detail/CVE-2023-23931","https://github.com/pyca/cryptography/commit/d6951dca25de45abd52da51b608055371fbcde4e","https://github.com/pyca/cryptography/pull/8230","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-11.yaml","https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html","https://security.netapp.com/advisory/ntap-20230324-0007"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w7pp-m8wf-vj6r","description":"Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf"},"relatedVulnerabilities":[{"id":"CVE-2023-23931","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23931","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-23931","date":"2026-10-08","epss":0.01301,"percentile":0.69604}],"urls":["https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3","https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r","https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html","https://security.netapp.com/advisory/ntap-20230324-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-23931","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14529","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14529","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14529","date":"2026-10-08","epss":0.01506,"percentile":0.73587}],"risk":0.753,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14529"},"relatedVulnerabilities":[{"id":"CVE-2017-14529","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14529","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14529","date":"2026-10-08","epss":0.01506,"percentile":0.73587}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22113","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=4d465c689a8fb27212ef358d0aee89d60dee69a6","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dcaaca89e8618eba35193c27afcb1cfa54f74582"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14529","description":"The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12454","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12454","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12454","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12454","date":"2026-10-08","epss":0.015,"percentile":0.73499}],"risk":0.75,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12454"},"relatedVulnerabilities":[{"id":"CVE-2017-12454","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12454","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12454","date":"2026-10-08","epss":0.015,"percentile":0.73499}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21813"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12454","description":"The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12458","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12458","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12458","date":"2026-10-08","epss":0.015,"percentile":0.73499}],"risk":0.75,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12458"},"relatedVulnerabilities":[{"id":"CVE-2017-12458","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12458","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12458","date":"2026-10-08","epss":0.015,"percentile":0.73499}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21840"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12458","description":"The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12456","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12456","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12456","date":"2026-10-08","epss":0.01496,"percentile":0.73408}],"risk":0.748,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12456"},"relatedVulnerabilities":[{"id":"CVE-2017-12456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12456","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12456","date":"2026-10-08","epss":0.01496,"percentile":0.73408}],"urls":["https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21813"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12456","description":"The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12453","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12453","date":"2026-10-08","epss":0.01493,"percentile":0.73366}],"risk":0.7465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12453"},"relatedVulnerabilities":[{"id":"CVE-2017-12453","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12453","date":"2026-10-08","epss":0.01493,"percentile":0.73366}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21813"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12453","description":"The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12455","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12455","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12455","date":"2026-10-08","epss":0.01493,"percentile":0.73366}],"risk":0.7465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12455"},"relatedVulnerabilities":[{"id":"CVE-2017-12455","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12455","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12455","date":"2026-10-08","epss":0.01493,"percentile":0.73366}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21840"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12455","description":"The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12451","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12451","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12451","date":"2026-10-08","epss":0.01493,"percentile":0.73365}],"risk":0.7465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12451"},"relatedVulnerabilities":[{"id":"CVE-2017-12451","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12451","date":"2026-10-08","epss":0.01493,"percentile":0.73365}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21786"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12451","description":"The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12452","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12452","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12452","date":"2026-10-08","epss":0.01493,"percentile":0.73365}],"risk":0.7465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12452"},"relatedVulnerabilities":[{"id":"CVE-2017-12452","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12452","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12452","date":"2026-10-08","epss":0.01493,"percentile":0.73365}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21813"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12452","description":"The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-7570","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-7570","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-7570","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7570","date":"2026-10-08","epss":0.01479,"percentile":0.73122}],"risk":0.7394999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-7570"},"relatedVulnerabilities":[{"id":"CVE-2018-7570","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7570","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7570","date":"2026-10-08","epss":0.01479,"percentile":0.73122}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22881","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=01f7e10cf2dcf403462b2feed06c43135651556d"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7570","description":"The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy."}]},{"artifact":{"id":"9ce65a8dd5f9de8a","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12%2Bdeb8u2?arch=all&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-2201","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"risk":0.7383,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-2201"},"relatedVulnerabilities":[{"id":"CVE-2019-2201","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00048.html","https://lists.apache.org/thread.html/rc800763a88775ac9abb83b3402bcd0913d41ac65fdfc759af38f2280%40%3Ccommits.mxnet.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/05/msg00048.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4QPASQPZO644STRFTLOD35RIRGWWRNI/","https://security.gentoo.org/glsa/202003-23","https://source.android.com/security/bulletin/2019-11-01","https://usn.ubuntu.com/4190-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2201","description":"In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338"}]},{"artifact":{"id":"ff79e707a754ecb1","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-2201","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"risk":0.7383,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-2201"},"relatedVulnerabilities":[{"id":"CVE-2019-2201","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00048.html","https://lists.apache.org/thread.html/rc800763a88775ac9abb83b3402bcd0913d41ac65fdfc759af38f2280%40%3Ccommits.mxnet.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/05/msg00048.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4QPASQPZO644STRFTLOD35RIRGWWRNI/","https://security.gentoo.org/glsa/202003-23","https://source.android.com/security/bulletin/2019-11-01","https://usn.ubuntu.com/4190-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2201","description":"In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338"}]},{"artifact":{"id":"d22e0dbc11f63e2c","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12\\+deb8u2:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12%2Bdeb8u2?arch=amd64&distro=debian-8.11&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12+deb8u2","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-2201","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"risk":0.7383,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-2201"},"relatedVulnerabilities":[{"id":"CVE-2019-2201","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-2201","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-2201","date":"2026-10-08","epss":0.02461,"percentile":0.83964}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00048.html","https://lists.apache.org/thread.html/rc800763a88775ac9abb83b3402bcd0913d41ac65fdfc759af38f2280%40%3Ccommits.mxnet.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/05/msg00048.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4QPASQPZO644STRFTLOD35RIRGWWRNI/","https://security.gentoo.org/glsa/202003-23","https://source.android.com/security/bulletin/2019-11-01","https://usn.ubuntu.com/4190-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2201","description":"In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338"}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13757","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13757","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13757","date":"2026-10-08","epss":0.01473,"percentile":0.73018}],"risk":0.7365,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13757"},"relatedVulnerabilities":[{"id":"CVE-2017-13757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13757","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13757","date":"2026-10-08","epss":0.01473,"percentile":0.73018}],"urls":["http://www.securityfocus.com/bid/100532","https://sourceware.org/bugzilla/show_bug.cgi?id=22018","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=90efb6422939ca031804266fba669f77c22a274a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13757","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12449","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12449","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12449","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12449","date":"2026-10-08","epss":0.01455,"percentile":0.72669}],"risk":0.7275,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12449"},"relatedVulnerabilities":[{"id":"CVE-2017-12449","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12449","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12449","date":"2026-10-08","epss":0.01455,"percentile":0.72669}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21840"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12449","description":"The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12457","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12457","date":"2026-10-08","epss":0.01448,"percentile":0.72539}],"risk":0.724,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12457"},"relatedVulnerabilities":[{"id":"CVE-2017-12457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12457","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12457","date":"2026-10-08","epss":0.01448,"percentile":0.72539}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=21840"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12457","description":"The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-8421","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8421","date":"2026-10-08","epss":0.00964,"percentile":0.60497}],"risk":0.723,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8421"},"relatedVulnerabilities":[{"id":"CVE-2017-8421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8421","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8421","date":"2026-10-08","epss":0.00964,"percentile":0.60497}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21440"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8421","description":"The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-44wm-f244-xhp3","versionConstraint":"<10.3.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-44wm-f244-xhp3","fix":{"state":"fixed","versions":["10.3.0"],"available":[{"date":"2024-04-04","kind":"first-observed","version":"10.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28219","cwe":"CWE-680","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28219","date":"2026-10-08","epss":0.00997,"percentile":0.61591}],"risk":0.7228249999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-28219","https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security","https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061","https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-44wm-f244-xhp3","description":"Pillow buffer overflow vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-28219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28219","cwe":"CWE-680","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-28219","date":"2026-10-08","epss":0.00997,"percentile":0.61591}],"urls":["https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/","https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/","https://github.com/advisories/GHSA-44wm-f244-xhp3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28219","description":"In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8x94-hmjh-97hq","versionConstraint":"<3.2.15 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8x94-hmjh-97hq","fix":{"state":"fixed","versions":["3.2.15"],"available":[{"date":"2022-08-12","kind":"first-observed","version":"3.2.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-36359","cwe":"CWE-494","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-36359","date":"2026-10-08","epss":0.00883,"percentile":0.57959}],"risk":0.719645,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-36359","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml","https://groups.google.com/g/django-announce/c/8cz--gvaJr4","http://www.openwall.com/lists/oss-security/2022/08/03/1","https://www.debian.org/security/2022/dsa-5254","https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80","https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3","https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","https://docs.djangoproject.com/en/4.0/releases/security","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI","https://security.netapp.com/advisory/ntap-20220915-0008","https://www.djangoproject.com/weblog/2022/aug/03/security-releases"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8x94-hmjh-97hq","description":"Django vulnerable to Reflected File Download attack"},"relatedVulnerabilities":[{"id":"CVE-2022-36359","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-36359","cwe":"CWE-494","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-36359","date":"2026-10-08","epss":0.00883,"percentile":0.57959}],"urls":["http://www.openwall.com/lists/oss-security/2022/08/03/1","https://docs.djangoproject.com/en/4.0/releases/security/","https://groups.google.com/g/django-announce/c/8cz--gvaJr4","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/","https://security.netapp.com/advisory/ntap-20220915-0008/","https://www.debian.org/security/2022/dsa-5254","https://www.djangoproject.com/weblog/2022/aug/03/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-36359","description":"An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15996","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15996","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15996","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15996","date":"2026-10-08","epss":0.02377,"percentile":0.83355}],"risk":0.7131,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15996"},"relatedVulnerabilities":[{"id":"CVE-2017-15996","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15996","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15996","date":"2026-10-08","epss":0.02377,"percentile":0.83355}],"urls":["http://www.securityfocus.com/bid/101608","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=22361","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d91f0b20e561e326ee91a09a76206257bde8438b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15996","description":"elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a \"buffer overflow on fuzzed archive header,\" related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48566","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.7||>= 3.9.0, < 3.9.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48566","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.7","3.9.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48566","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48566","date":"2026-10-08","epss":0.01301,"percentile":0.6959}],"risk":0.709045,"urls":["https://bugs.python.org/issue40791","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://security.netapp.com/advisory/ntap-20231006-0013/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48566","description":"An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4330","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4330","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-4330","fix":{"state":"fixed","versions":["3.9.23","3.10.18","3.11.13","3.12.11","3.13.4","3.14.0b3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.23"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.18"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.4"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.0b3"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.23"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.18"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.14.0b3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4330","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4330","date":"2026-10-08","epss":0.00939,"percentile":0.59709}],"risk":0.70425,"urls":["https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f","https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da","https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9","https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a","https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e","https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a","https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a","https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01","https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1","https://github.com/python/cpython/issues/135034","https://github.com/python/cpython/pull/135037","https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4330","description":"Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\n\n\nYou are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of \"data\" or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.\n\nNote that for Python 3.14 or later the default value of filter= changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d4911a4b1b9466a","cpes":["cpe:2.3:a:python-djangorestframework:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python-djangorestframework:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python_djangorestframework:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python_djangorestframework:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie_project:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie_project:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:djangorestframework:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:djangorestframework:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python-djangorestframework:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python_djangorestframework:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christieproject:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christieproject:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie_project:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:djangorestframework:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christieproject:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_project:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_project:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tomproject:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tomproject:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_christie:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom_project:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom:python-djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom:python_djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tomproject:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:python:djangorestframework:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:tom:djangorestframework:2.4.8:*:*:*:*:*:*:*"],"name":"djangorestframework","purl":"pkg:pypi/djangorestframework@2.4.8","type":"python","version":"2.4.8","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/djangorestframework-2.4.8.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fx83-3ph3-9j2q","versionConstraint":"<3.11.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"djangorestframework","version":"2.4.8"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-fx83-3ph3-9j2q","fix":{"state":"fixed","versions":["3.11.2"],"available":[{"date":"2021-03-20","kind":"first-observed","version":"3.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25626","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25626","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25626","date":"2026-10-08","epss":0.01286,"percentile":0.69288}],"risk":0.6880099999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-25626","https://bugzilla.redhat.com/show_bug.cgi?id=1878635","https://www.debian.org/security/2022/dsa-5186","https://github.com/pypa/advisory-database/tree/main/vulns/djangorestframework/PYSEC-2020-263.yaml","https://security.netapp.com/advisory/ntap-20201016-0003"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fx83-3ph3-9j2q","description":"Cross-site Scripting (XSS) in Django REST Framework"},"relatedVulnerabilities":[{"id":"CVE-2020-25626","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25626","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25626","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25626","date":"2026-10-08","epss":0.01286,"percentile":0.69288}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1878635","https://security.netapp.com/advisory/ntap-20201016-0003/","https://www.debian.org/security/2022/dsa-5186"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-18207","versionConstraint":"<= 3.6.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-18207","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18207","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18207","date":"2026-10-08","epss":0.01323,"percentile":0.70031}],"risk":0.68796,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue32056"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18207","description":"The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications \"need to be prepared to handle a wide variety of exceptions."},"relatedVulnerabilities":[]},{"artifact":{"id":"1deb7999092a4386","cpes":["cpe:2.3:a:libxmlsec1:libxmlsec1:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1","purl":"pkg:deb/debian/libxmlsec1@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1.list"},{"path":"/var/lib/dpkg/info/libxmlsec1.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1.postinst"},{"path":"/var/lib/dpkg/info/libxmlsec1.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1.postrm"},{"path":"/var/lib/dpkg/info/libxmlsec1.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1.shlibs"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"c546d1540588bdc9","cpes":["cpe:2.3:a:libxmlsec1-dev:libxmlsec1-dev:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1-dev:libxmlsec1_dev:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_dev:libxmlsec1-dev:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_dev:libxmlsec1_dev:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1-dev:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1_dev:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1-dev","purl":"pkg:deb/debian/libxmlsec1-dev@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-dev.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-dev.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-dev.list"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"af2cb037b7607db3","cpes":["cpe:2.3:a:libxmlsec1-gcrypt:libxmlsec1-gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1-gcrypt:libxmlsec1_gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_gcrypt:libxmlsec1-gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_gcrypt:libxmlsec1_gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1-gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1_gcrypt:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1-gcrypt","purl":"pkg:deb/debian/libxmlsec1-gcrypt@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1-gcrypt/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1-gcrypt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-gcrypt.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gcrypt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-gcrypt.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gcrypt.list"},{"path":"/var/lib/dpkg/info/libxmlsec1-gcrypt.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gcrypt.postinst"},{"path":"/var/lib/dpkg/info/libxmlsec1-gcrypt.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gcrypt.postrm"},{"path":"/var/lib/dpkg/info/libxmlsec1-gcrypt.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gcrypt.shlibs"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"e8b441425b1e8f6a","cpes":["cpe:2.3:a:libxmlsec1-gnutls:libxmlsec1-gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1-gnutls:libxmlsec1_gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_gnutls:libxmlsec1-gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_gnutls:libxmlsec1_gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1-gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1_gnutls:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1-gnutls","purl":"pkg:deb/debian/libxmlsec1-gnutls@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1-gnutls/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-gnutls.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gnutls.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-gnutls.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gnutls.list"},{"path":"/var/lib/dpkg/info/libxmlsec1-gnutls.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gnutls.postinst"},{"path":"/var/lib/dpkg/info/libxmlsec1-gnutls.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gnutls.postrm"},{"path":"/var/lib/dpkg/info/libxmlsec1-gnutls.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-gnutls.shlibs"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"c2b9d40d850dab85","cpes":["cpe:2.3:a:libxmlsec1-nss:libxmlsec1-nss:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1-nss:libxmlsec1_nss:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_nss:libxmlsec1-nss:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_nss:libxmlsec1_nss:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1-nss:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1_nss:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1-nss","purl":"pkg:deb/debian/libxmlsec1-nss@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1-nss/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1-nss/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-nss.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-nss.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-nss.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-nss.list"},{"path":"/var/lib/dpkg/info/libxmlsec1-nss.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-nss.postinst"},{"path":"/var/lib/dpkg/info/libxmlsec1-nss.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-nss.postrm"},{"path":"/var/lib/dpkg/info/libxmlsec1-nss.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-nss.shlibs"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"9ace50cb42bdba0d","cpes":["cpe:2.3:a:libxmlsec1-openssl:libxmlsec1-openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1-openssl:libxmlsec1_openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_openssl:libxmlsec1-openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1_openssl:libxmlsec1_openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1-openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libxmlsec1:libxmlsec1_openssl:1.2.20-2\\+b1:*:*:*:*:*:*:*"],"name":"libxmlsec1-openssl","purl":"pkg:deb/debian/libxmlsec1-openssl@1.2.20-2%2Bb1?arch=amd64&distro=debian-8.11&upstream=xmlsec1%401.2.20-2","type":"deb","version":"1.2.20-2+b1","language":"","licenses":["sha256:c8087695b08db8176cda995f660c4d91ca42ea2aa92f736b59f6a48862921313"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxmlsec1-openssl/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libxmlsec1-openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-openssl.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxmlsec1-openssl.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-openssl.list"},{"path":"/var/lib/dpkg/info/libxmlsec1-openssl.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-openssl.postinst"},{"path":"/var/lib/dpkg/info/libxmlsec1-openssl.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-openssl.postrm"},{"path":"/var/lib/dpkg/info/libxmlsec1-openssl.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libxmlsec1-openssl.shlibs"}],"upstreams":[{"name":"xmlsec1","version":"1.2.20-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"xmlsec1","version":"1.2.20-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"risk":0.6705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000061"},"relatedVulnerabilities":[{"id":"CVE-2017-1000061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000061","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000061","date":"2026-10-08","epss":0.01341,"percentile":0.70477}],"urls":["https://access.redhat.com/errata/RHSA-2017:2492","https://github.com/lsh123/xmlsec/issues/43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service"}]},{"artifact":{"id":"2d1698c108ea8bf2","cpes":["cpe:2.3:a:apt:apt:1.0.9.8.5:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@1.0.9.8.5?arch=amd64&distro=debian-8.11","type":"deb","version":"1.0.9.8.5","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-3810","versionConstraint":"< 1.0.9.8.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"apt","version":"1.0.9.8.5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-3810","fix":{"state":"fixed","versions":["1.0.9.8.6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-3810","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-3810","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-3810","date":"2026-10-08","epss":0.01338,"percentile":0.704}],"risk":0.6689999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-3810"},"relatedVulnerabilities":[{"id":"CVE-2020-3810","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-3810","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-3810","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-3810","date":"2026-10-08","epss":0.01338,"percentile":0.704}],"urls":["https://bugs.launchpad.net/bugs/1878177","https://github.com/Debian/apt/issues/111","https://lists.debian.org/debian-security-announce/2020/msg00089.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4PEH357MZM2SUGKETMEHMSGQS652QHH/","https://salsa.debian.org/apt-team/apt/-/commit/dceb1e49e4b8e4dadaf056be34088b415939cda6","https://tracker.debian.org/news/1144109/accepted-apt-212-source-into-unstable/","https://usn.ubuntu.com/4359-1/","https://usn.ubuntu.com/4359-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-3810","description":"Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files."}]},{"artifact":{"id":"292902aa8305d4b3","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.9.8.5:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/debian/libapt-pkg4.12@1.0.9.8.5?arch=amd64&distro=debian-8.11&upstream=apt","type":"deb","version":"1.0.9.8.5","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-3810","versionConstraint":"< 1.0.9.8.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"apt","version":"1.0.9.8.5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-3810","fix":{"state":"fixed","versions":["1.0.9.8.6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-3810","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-3810","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-3810","date":"2026-10-08","epss":0.01338,"percentile":0.704}],"risk":0.6689999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-3810"},"relatedVulnerabilities":[{"id":"CVE-2020-3810","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-3810","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-3810","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-3810","date":"2026-10-08","epss":0.01338,"percentile":0.704}],"urls":["https://bugs.launchpad.net/bugs/1878177","https://github.com/Debian/apt/issues/111","https://lists.debian.org/debian-security-announce/2020/msg00089.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4PEH357MZM2SUGKETMEHMSGQS652QHH/","https://salsa.debian.org/apt-team/apt/-/commit/dceb1e49e4b8e4dadaf056be34088b415939cda6","https://tracker.debian.org/news/1144109/accepted-apt-212-source-into-unstable/","https://usn.ubuntu.com/4359-1/","https://usn.ubuntu.com/4359-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-3810","description":"Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-16830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16830","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16830","date":"2026-10-08","epss":0.02201,"percentile":0.81973}],"risk":0.6603,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16830"},"relatedVulnerabilities":[{"id":"CVE-2017-16830","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16830","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16830","date":"2026-10-08","epss":0.02201,"percentile":0.81973}],"urls":["http://www.securityfocus.com/bid/101941","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22384","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=6ab2c4ed51f9c4243691755e1b1d2149c6a426f4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16830","description":"The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file."}]},{"artifact":{"id":"7b44787e28e2d3fa","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:4.2.1:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@4.2.1","type":"python","version":"4.2.1","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-4.2.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g6rj-rv7j-xwp4","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"4.2.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-g6rj-rv7j-xwp4","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28675","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28675","date":"2026-10-08","epss":0.00956,"percentile":0.60229}],"risk":0.65964,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28675","https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin","https://security.gentoo.org/glsa/202107-33","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g6rj-rv7j-xwp4","description":"Pillow denial of service"},"relatedVulnerabilities":[{"id":"CVE-2021-28675","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28675","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28675","date":"2026-10-08","epss":0.00956,"percentile":0.60229}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin","https://security.gentoo.org/glsa/202107-33"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28675","description":"An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15020","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15020","date":"2026-10-08","epss":0.02165,"percentile":0.81692}],"risk":0.6495,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15020"},"relatedVulnerabilities":[{"id":"CVE-2017-15020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15020","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15020","date":"2026-10-08","epss":0.02165,"percentile":0.81692}],"urls":["https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22202","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15020","description":"dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9043","date":"2026-10-08","epss":0.02129,"percentile":0.81385}],"risk":0.6386999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9043"},"relatedVulnerabilities":[{"id":"CVE-2017-9043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9043","date":"2026-10-08","epss":0.02129,"percentile":0.81385}],"urls":["http://www.securityfocus.com/bid/98591","https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=ddef72cdc10d82ba011a7ff81cafbbd3466acf54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9043","description":"readelf.c in GNU Binutils 2017-04-12 has a \"shift exponent too large for type unsigned long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9038","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9038","date":"2026-10-08","epss":0.02109,"percentile":0.81201}],"risk":0.6327,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9038"},"relatedVulnerabilities":[{"id":"CVE-2017-9038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9038","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9038","date":"2026-10-08","epss":0.02109,"percentile":0.81201}],"urls":["http://www.securityfocus.com/bid/98589","https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=f32ba72991d2406b21ab17edc234a2f3fa7fb23d"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9038","description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15023","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15023","date":"2026-10-08","epss":0.02091,"percentile":0.81041}],"risk":0.6273,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15023"},"relatedVulnerabilities":[{"id":"CVE-2017-15023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15023","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15023","date":"2026-10-08","epss":0.02091,"percentile":0.81041}],"urls":["http://www.securityfocus.com/bid/101611","https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=22200","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=c361faae8d964db951b7100cada4dcdc983df1bf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15023","description":"read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9040","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9040","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9040","date":"2026-10-08","epss":0.02065,"percentile":0.80795}],"risk":0.6195,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9040"},"relatedVulnerabilities":[{"id":"CVE-2017-9040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9040","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9040","date":"2026-10-08","epss":0.02065,"percentile":0.80795}],"urls":["http://www.securityfocus.com/bid/98579","https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7296a62a2a237f6b1ad8db8c38b090e9f592c8cf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9040","description":"GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9039","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9039","date":"2026-10-08","epss":0.02065,"percentile":0.80794}],"risk":0.6195,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9039"},"relatedVulnerabilities":[{"id":"CVE-2017-9039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9039","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9039","date":"2026-10-08","epss":0.02065,"percentile":0.80794}],"urls":["http://www.securityfocus.com/bid/98580","https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=82156ab704b08b124d319c0decdbd48b3ca2dac5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9039","description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9042","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9042","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9042","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9042","date":"2026-10-08","epss":0.02063,"percentile":0.80773}],"risk":0.6188999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9042"},"relatedVulnerabilities":[{"id":"CVE-2017-9042","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9042","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9042","date":"2026-10-08","epss":0.02063,"percentile":0.80773}],"urls":["https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7296a62a2a237f6b1ad8db8c38b090e9f592c8cf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9042","description":"readelf.c in GNU Binutils 2017-04-12 has a \"cannot be represented in type long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file."}]},{"artifact":{"id":"323e87d365c3aba5","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=ncurses","type":"deb","version":"5.9+20140913-1+deb8u3","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"ncurses","version":"5.9+20140913-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"risk":0.6153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17595"},"relatedVulnerabilities":[{"id":"CVE-2019-17595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","https://security.gentoo.org/glsa/202101-28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012."}]},{"artifact":{"id":"befe86f7dd43dc6b","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=ncurses","type":"deb","version":"5.9+20140913-1+deb8u3","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"ncurses","version":"5.9+20140913-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"risk":0.6153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17595"},"relatedVulnerabilities":[{"id":"CVE-2019-17595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","https://security.gentoo.org/glsa/202101-28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012."}]},{"artifact":{"id":"656e332f592aa033","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=ncurses","type":"deb","version":"5.9+20140913-1+deb8u3","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"ncurses","version":"5.9+20140913-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"risk":0.6153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17595"},"relatedVulnerabilities":[{"id":"CVE-2019-17595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","https://security.gentoo.org/glsa/202101-28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012."}]},{"artifact":{"id":"7a84ebf816a6b85d","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1%2Bdeb8u3?arch=all&distro=debian-8.11&upstream=ncurses","type":"deb","version":"5.9+20140913-1+deb8u3","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"ncurses","version":"5.9+20140913-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"risk":0.6153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17595"},"relatedVulnerabilities":[{"id":"CVE-2019-17595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","https://security.gentoo.org/glsa/202101-28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012."}]},{"artifact":{"id":"a7deaf9924fd8f63","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bdeb8u3?arch=amd64&distro=debian-8.11&upstream=ncurses","type":"deb","version":"5.9+20140913-1+deb8u3","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"ncurses","version":"5.9+20140913-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"risk":0.6153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17595"},"relatedVulnerabilities":[{"id":"CVE-2019-17595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17595","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17595","date":"2026-10-08","epss":0.02051,"percentile":0.80655}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","https://security.gentoo.org/glsa/202101-28"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6100","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.14||>= 3.14.0a1, < 3.14.5rc1||>= 3.15.0a1, < 3.15.0b1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6100","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.14||>= 3.14.0a1, < 3.14.5rc1||>= 3.15.0a1, < 3.15.0b1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6100","fix":{"state":"fixed","versions":["3.10.21","3.11.16","3.12.14","3.13.14","3.14.5rc1","3.15.0b1"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.10.21"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.14"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.14"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.5rc1"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0b1"},{"date":"2026-08-19","kind":"first-observed","version":"3.10.21"},{"date":"2026-08-19","kind":"first-observed","version":"3.11.16"},{"date":"2026-08-19","kind":"first-observed","version":"3.12.14"},{"date":"2026-07-02","kind":"first-observed","version":"3.13.14"},{"date":"2026-07-02","kind":"first-observed","version":"3.14.5rc1"},{"date":"2026-07-02","kind":"first-observed","version":"3.15.0b1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6100","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-787","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6100","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6100","date":"2026-10-08","epss":0.00761,"percentile":0.53914}],"risk":0.612605,"urls":["https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e","https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b","https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3","https://github.com/python/cpython/issues/148395","https://github.com/python/cpython/pull/148396","https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","http://www.openwall.com/lists/oss-security/2026/04/13/10","https://access.redhat.com/errata/RHSA-2026:10117","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10711","https://access.redhat.com/errata/RHSA-2026:10745","https://access.redhat.com/errata/RHSA-2026:10774","https://access.redhat.com/errata/RHSA-2026:10949","https://access.redhat.com/errata/RHSA-2026:10950","https://access.redhat.com/errata/RHSA-2026:11062","https://access.redhat.com/errata/RHSA-2026:11077","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13692","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14652","https://access.redhat.com/errata/RHSA-2026:14653","https://access.redhat.com/errata/RHSA-2026:14656","https://access.redhat.com/errata/RHSA-2026:16699","https://access.redhat.com/errata/RHSA-2026:17525","https://access.redhat.com/errata/RHSA-2026:17619","https://access.redhat.com/errata/RHSA-2026:19019","https://access.redhat.com/errata/RHSA-2026:19064","https://access.redhat.com/errata/RHSA-2026:19175","https://access.redhat.com/errata/RHSA-2026:19176","https://access.redhat.com/errata/RHSA-2026:19177","https://access.redhat.com/errata/RHSA-2026:19216","https://access.redhat.com/errata/RHSA-2026:19549","https://access.redhat.com/errata/RHSA-2026:19570","https://access.redhat.com/errata/RHSA-2026:19571","https://access.redhat.com/errata/RHSA-2026:19576","https://access.redhat.com/errata/RHSA-2026:19590","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:21682","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:26187","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:52400","https://access.redhat.com/errata/RHSA-2026:8822","https://access.redhat.com/errata/RHSA-2026:8824","https://access.redhat.com/errata/RHSA-2026:9228","https://access.redhat.com/security/cve/CVE-2026-6100","https://bugzilla.redhat.com/show_bug.cgi?id=2457932","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","description":"Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.\n\nThe vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14333","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14333","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14333","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14333","date":"2026-10-08","epss":0.01216,"percentile":0.67689}],"risk":0.608,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14333"},"relatedVulnerabilities":[{"id":"CVE-2017-14333","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14333","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14333","date":"2026-10-08","epss":0.01216,"percentile":0.67689}],"urls":["https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21990"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14333","description":"The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during \"readelf -a\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14938","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14938","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14938","date":"2026-10-08","epss":0.02024,"percentile":0.80393}],"risk":0.6072,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14938"},"relatedVulnerabilities":[{"id":"CVE-2017-14938","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14938","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14938","date":"2026-10-08","epss":0.02024,"percentile":0.80393}],"urls":["http://www.securityfocus.com/bid/101212","https://blogs.gentoo.org/ago/2017/09/26/binutils-memory-allocation-failure-in-_bfd_elf_slurp_version_tables-elf-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22166","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=bd61e135492ecf624880e6b78e5fcde3c9716df6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14938","description":"_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15022","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15022","date":"2026-10-08","epss":0.02017,"percentile":0.80321}],"risk":0.6051,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15022"},"relatedVulnerabilities":[{"id":"CVE-2017-15022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15022","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15022","date":"2026-10-08","epss":0.02017,"percentile":0.80321}],"urls":["https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-bfd_hash_hash-hash-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22201","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11855d8a1f11b102a702ab76e95b22082cccf2f8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15022","description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15021","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15021","date":"2026-10-08","epss":0.02017,"percentile":0.8032}],"risk":0.6051,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15021"},"relatedVulnerabilities":[{"id":"CVE-2017-15021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15021","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15021","date":"2026-10-08","epss":0.02017,"percentile":0.8032}],"urls":["https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-bfd_getl32-opncls-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22197","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=52b36c51e5bf6d7600fdc6ba115b170b0e78e31d"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15021","description":"bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"risk":0.604,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000409"},"relatedVulnerabilities":[{"id":"CVE-2017-1000409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"urls":["http://seclists.org/oss-sec/2017/q4/385","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000409","description":"A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"risk":0.604,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000409"},"relatedVulnerabilities":[{"id":"CVE-2017-1000409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"urls":["http://seclists.org/oss-sec/2017/q4/385","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000409","description":"A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"risk":0.604,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000409"},"relatedVulnerabilities":[{"id":"CVE-2017-1000409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"urls":["http://seclists.org/oss-sec/2017/q4/385","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000409","description":"A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"risk":0.604,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000409"},"relatedVulnerabilities":[{"id":"CVE-2017-1000409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"urls":["http://seclists.org/oss-sec/2017/q4/385","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000409","description":"A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.11&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:b0981bc6621f4e8842fa68d274ffc906b6b1c62c97124953f679639113f0444b","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"risk":0.604,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000409"},"relatedVulnerabilities":[{"id":"CVE-2017-1000409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000409","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000409","date":"2026-10-08","epss":0.01208,"percentile":0.67457}],"urls":["http://seclists.org/oss-sec/2017/q4/385","https://security.netapp.com/advisory/ntap-20190404-0003/","https://www.exploit-db.com/exploits/43331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000409","description":"A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.14||>= 3.11.0, < 3.11.9||>= 3.12.0, < 3.12.3||>= 3.13.0a1, < 3.13.0a5||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-0397","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.14||>= 3.11.0, < 3.11.9||>= 3.12.0, < 3.12.3||>= 3.13.0a1, < 3.13.0a5||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.14","3.11.9","3.12.3","3.13.0a5"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.14"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.9"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.3"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0a5"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.14"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.3"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0a5"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-10-08","epss":0.0081,"percentile":0.55628}],"risk":0.60345,"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14745","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14745","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14745","date":"2026-10-08","epss":0.01201,"percentile":0.67283}],"risk":0.6005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14745"},"relatedVulnerabilities":[{"id":"CVE-2017-14745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14745","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14745","date":"2026-10-08","epss":0.01201,"percentile":0.67283}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=22148"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14745","description":"The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-8945","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-8945","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-8945","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8945","date":"2026-10-08","epss":0.01987,"percentile":0.79987}],"risk":0.5961,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-8945"},"relatedVulnerabilities":[{"id":"CVE-2018-8945","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8945","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8945","date":"2026-10-08","epss":0.01987,"percentile":0.79987}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22809","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8945","description":"The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-6965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-6965","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-6965","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6965","date":"2026-10-08","epss":0.01163,"percentile":0.66258}],"risk":0.5815,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-6965"},"relatedVulnerabilities":[{"id":"CVE-2017-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6965","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6965","date":"2026-10-08","epss":0.01163,"percentile":0.66258}],"urls":["https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21137"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6965","description":"readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14940","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14940","date":"2026-10-08","epss":0.01938,"percentile":0.79485}],"risk":0.5814,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14940"},"relatedVulnerabilities":[{"id":"CVE-2017-14940","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14940","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14940","date":"2026-10-08","epss":0.01938,"percentile":0.79485}],"urls":["https://blogs.gentoo.org/ago/2017/09/26/binutils-null-pointer-dereference-in-scan_unit_for_symbols-dwarf2-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22166","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0d76029f92182c3682d8be2c833d45bc9a2068fe"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14940","description":"scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.5||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6923","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.5||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-6923","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.5","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.5"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.5"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.5,"impactScore":3.4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6923","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-6923","date":"2026-10-08","epss":0.011,"percentile":0.64652}],"risk":0.5775,"urls":["https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147","https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384","https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7","https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0","https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1","https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6","https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533","https://github.com/python/cpython/issues/121650","https://github.com/python/cpython/pull/122233","https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/","http://www.openwall.com/lists/oss-security/2024/08/01/3","http://www.openwall.com/lists/oss-security/2024/08/02/2","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html","https://security.netapp.com/advisory/ntap-20240926-0003/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6923","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7224","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7224","date":"2026-10-08","epss":0.01154,"percentile":0.66028}],"risk":0.577,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7224"},"relatedVulnerabilities":[{"id":"CVE-2017-7224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7224","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7224","date":"2026-10-08","epss":0.01154,"percentile":0.66028}],"urls":["http://www.securityfocus.com/bid/97277","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20892"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7224","description":"The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9041","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9041","date":"2026-10-08","epss":0.01921,"percentile":0.79294}],"risk":0.5763,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9041"},"relatedVulnerabilities":[{"id":"CVE-2017-9041","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9041","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9041","date":"2026-10-08","epss":0.01921,"percentile":0.79294}],"urls":["http://www.securityfocus.com/bid/98598","https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=75ec1fdbb797a389e4fe4aaf2e15358a070dcc19","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=c4ab9505b53cdc899506ed421fddb7e1f8faf7a3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9041","description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4492","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4492","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4492","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4492","date":"2026-10-08","epss":0.01915,"percentile":0.79216}],"risk":0.5745,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4492"},"relatedVulnerabilities":[{"id":"CVE-2016-4492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4492","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4492","date":"2026-10-08","epss":0.01915,"percentile":0.79216}],"urls":["http://www.openwall.com/lists/oss-security/2016/05/05/5","http://www.securityfocus.com/bid/90014","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926","https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4492","description":"Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-11940","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0b4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-11940","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0b4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"fixed","versions":["3.10.21","3.11.16","3.12.14","3.13.15","3.14.7","3.15.0b4"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.10.21"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.14"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.7"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0b4"},{"date":"2026-08-19","kind":"first-observed","version":"3.10.21"},{"date":"2026-08-19","kind":"first-observed","version":"3.11.16"},{"date":"2026-08-19","kind":"first-observed","version":"3.12.14"},{"date":"2026-08-12","kind":"first-observed","version":"3.13.15"},{"date":"2026-08-12","kind":"first-observed","version":"3.14.7"},{"date":"2026-07-30","kind":"first-observed","version":"3.15.0b4"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-10-08","epss":0.0075,"percentile":0.53541}],"risk":0.57375,"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."},"relatedVulnerabilities":[]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-17122","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-17122","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-17122","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17122","date":"2026-10-08","epss":0.01885,"percentile":0.78876}],"risk":0.5654999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-17122"},"relatedVulnerabilities":[{"id":"CVE-2017-17122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17122","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17122","date":"2026-10-08","epss":0.01885,"percentile":0.78876}],"urls":["https://security.gentoo.org/glsa/201811-17","https://sourceware.org/bugzilla/show_bug.cgi?id=22508","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d785b7d4b877ed465d04072e17ca19d0f47d840f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17122","description":"The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.11","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:7eb75b4fb1e5012b27bcf221877408e3613574a4de01b71e4139d5f2318cb59f","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:ee2d7702dd2279b8e46f05f711aa13b0c8f72a1bd65288882eb3a3d8cc38d0ee","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7299","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.11"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7299","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7299","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7299","date":"2026-10-08","epss":0.01126,"percentile":0.65297}],"risk":0.563,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7299"},"relatedVulnerabilities":[{"id":"CVE-2017-7299","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7299","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7299","date":"2026-10-08","epss":0.01126,"percentile":0.65297}],"urls":["http://www.securityfocus.com/bid/97217","https://sourceware.org/bugzilla/show_bug.cgi?id=20908"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7299","description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash."}]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-50602","versionConstraint":"< 3.9.21||>= 3.10, < 3.10.16||>= 3.11, < 3.11.11||>= 3.12, < 3.12.8||>= 3.13, < 3.13.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-50602","versionConstraint":"< 3.9.21||>= 3.10, < 3.10.16||>= 3.11, < 3.11.11||>= 3.12, < 3.12.8||>= 3.13, < 3.13.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-50602","fix":{"state":"fixed","versions":["3.9.21","3.10.16","3.11.11","3.12.8","3.13.1"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.21"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.8"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.1"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.21"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50602","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50602","date":"2026-10-08","epss":0.01033,"percentile":0.62707}],"risk":0.5629850000000001,"urls":["https://github.com/libexpat/libexpat/pull/915","https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html","https://security.netapp.com/advisory/ntap-20250404-0008/","https://docs.python.org/release/3.10.16/whatsnew/changelog.html","https://docs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11","https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8","https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1","https://docs.python.org/release/3.9.21/whatsnew/changelog.html","https://github.com/python/cpython/issues/126623"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser."},"relatedVulnerabilities":[]},{"artifact":{"id":"a029cbac7a849d13","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.16","type":"binary","version":"2.7.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:d7d1cbf9678f7c64140dee4b9b0dae9758024c620550a6dd30f8a3ad82459d9f","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-11972","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0b4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.10.21"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-11972","versionConstraint":"< 3.10.21||>= 3.11.0, < 3.11.16||>= 3.12.0, < 3.12.14||>= 3.13.0, < 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0b4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"fixed","versions":["3.10.21","3.11.16","3.12.14","3.13.15","3.14.7","3.15.0b4"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.10.21"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.14"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.7"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0b4"},{"date":"2026-08-19","kind":"first-observed","version":"3.10.21"},{"date":"2026-08-19","kind":"first-observed","version":"3.11.16"},{"date":"2026-08-19","kind":"first-observed","version":"3.12.14"},{"date":"2026-08-12","kind":"first-observed","version":"3.13.15"},{"date":"2026-08-12","kind":"first-observed","version":"3.14.7"},{"date":"2026-07-30","kind":"first-observed","version":"3.15.0b4"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-10-08","epss":0.00715,"percentile":0.52297}],"risk":0.561275,"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-09T11:42:30.374Z","grype_db_version":"2026-10-09T06:32:32.000Z"}