{"grype_matches":[{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-11-11","epss":0.04697,"percentile":0.91916}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-47917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-47917","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-11-11","epss":0.02443,"percentile":0.84533}],"risk":1.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-47917"},"relatedVulnerabilities":[{"id":"CVE-2025-47917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H","metrics":{"baseScore":8.9,"impactScore":6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-11-11","epss":0.02443,"percentile":0.84533}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47917","description":"Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-11-11","epss":0.01572,"percentile":0.75727}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-11-11","epss":0.01545,"percentile":0.75324}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"077b27b180a9ce9b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.8?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-11","epss":0.01545,"percentile":0.75316}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119586"},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-11","epss":0.01545,"percentile":0.75316}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-11-11","epss":0.01436,"percentile":0.73474}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"bfe0855a529838fa","cpes":["cpe:2.3:a:apt:apt:2.8.3:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@2.8.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.8.3","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.shlibs"},{"path":"/var/lib/dpkg/info/apt.triggers","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/apt.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.4ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 2.8.4ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apt","version":"2.8.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["2.8.4ubuntu0.1"],"available":[{"date":"2026-11-04","kind":"advisory","version":"2.8.4ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-11","epss":0.00928,"percentile":0.60985}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-11","epss":0.00928,"percentile":0.60985}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"13d506459809d51e","cpes":["cpe:2.3:a:libapt-pkg6.0t64:libapt-pkg6.0t64:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg6.0t64:libapt_pkg6.0t64:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg6.0t64:libapt-pkg6.0t64:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg6.0t64:libapt_pkg6.0t64:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg6.0t64:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg6.0t64:2.8.3:*:*:*:*:*:*:*"],"name":"libapt-pkg6.0t64","purl":"pkg:deb/ubuntu/libapt-pkg6.0t64@2.8.3?arch=amd64&distro=ubuntu-24.04&upstream=apt","type":"deb","version":"2.8.3","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg6.0t64/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libapt-pkg6.0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg6.0t64:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libapt-pkg6.0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.4ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 2.8.4ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apt","version":"2.8.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["2.8.4ubuntu0.1"],"available":[{"date":"2026-11-04","kind":"advisory","version":"2.8.4ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-11","epss":0.00928,"percentile":0.60985}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-11","epss":0.00928,"percentile":0.60985}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-11-11","epss":0.01179,"percentile":0.6808}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-11","epss":0.01824,"percentile":0.79074}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-11","epss":0.01824,"percentile":0.79074}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-11","epss":0.01824,"percentile":0.79074}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-11","epss":0.01824,"percentile":0.79074}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-11-11","epss":0.0182,"percentile":0.79027}],"risk":0.546,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-11-11","epss":0.0182,"percentile":0.79027}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"944752b806948053","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-12781","versionConstraint":"< 3.13.10||>= 3.14.0, < 3.14.1||>= 3.15.0a1, < 3.15.0a2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"fixed","versions":["3.13.10","3.14.1","3.15.0a2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a2"},{"date":"2026-06-18","kind":"first-observed","version":"3.13.10"},{"date":"2026-06-18","kind":"first-observed","version":"3.14.1"},{"date":"2026-06-18","kind":"first-observed","version":"3.15.0a2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"risk":0.46386000000000005,"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."},"relatedVulnerabilities":[]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-24119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2021-24119","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-24119","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24119","date":"2026-11-11","epss":0.01484,"percentile":0.74319}],"risk":0.44520000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-24119"},"relatedVulnerabilities":[{"id":"CVE-2021-24119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-24119","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24119","date":"2026-11-11","epss":0.01484,"percentile":0.74319}],"urls":["https://github.com/ARMmbed/mbedtls/releases","https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md","https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html","https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/","https://lists.debian.org/debian-lts-announce/2025/06/msg00034.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-24119","description":"In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-11","epss":0.0148,"percentile":0.74255}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-11","epss":0.0148,"percentile":0.74255}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-11","epss":0.0148,"percentile":0.74255}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-11-11","epss":0.0148,"percentile":0.74255}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-11","epss":0.00859,"percentile":0.5891}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-11","epss":0.00829,"percentile":0.57946}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-11","epss":0.00829,"percentile":0.57946}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-11","epss":0.00829,"percentile":0.57946}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-11-11","epss":0.00829,"percentile":0.57946}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-11-11","epss":0.0077,"percentile":0.56054}],"risk":0.385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57052"},"relatedVulnerabilities":[{"id":"CVE-2025-57052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-11-11","epss":0.0077,"percentile":0.56054}],"urls":["https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability","https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-11","epss":0.00762,"percentile":0.55799}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-11","epss":0.0075,"percentile":0.55411}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-11-11","epss":0.00727,"percentile":0.54597}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-11","epss":0.00715,"percentile":0.54182}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-11-11","epss":0.0071,"percentile":0.53967}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-11-11","epss":0.00702,"percentile":0.53693}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67215","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-11-11","epss":0.007,"percentile":0.53597}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67215"},"relatedVulnerabilities":[{"id":"CVE-2026-67215","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-11-11","epss":0.007,"percentile":0.53597}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-11-11","epss":0.00689,"percentile":0.53191}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-11-11","epss":0.00681,"percentile":0.52865}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-11","epss":0.00674,"percentile":0.52579}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-11","epss":0.00674,"percentile":0.52579}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-11","epss":0.00674,"percentile":0.52579}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-11-11","epss":0.00674,"percentile":0.52579}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"9c02489cc4237990","cpes":["cpe:2.3:a:libx264-164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264-164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*"],"name":"libx264-164","purl":"pkg:deb/ubuntu/libx264-164@2%3A0.164.3108%2Bgit31e19f9-1?arch=amd64&distro=ubuntu-24.04&upstream=x264","type":"deb","version":"2:0.164.3108+git31e19f9-1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","ISC","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx264-164/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libx264-164/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"x264"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x264","version":"2:0.164.3108+git31e19f9-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-11-11","epss":0.00672,"percentile":0.52531}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-11","epss":0.00672,"percentile":0.52498}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-11-11","epss":0.00671,"percentile":0.52482}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31755","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31755","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-11-11","epss":0.00648,"percentile":0.51534}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31755"},"relatedVulnerabilities":[{"id":"CVE-2024-31755","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-11-11","epss":0.00648,"percentile":0.51534}],"urls":["https://github.com/DaveGamble/cJSON/issues/839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31755","description":"cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-11","epss":0.00648,"percentile":0.51514}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-11","epss":0.00648,"percentile":0.51514}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-11","epss":0.00648,"percentile":0.51514}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-11-11","epss":0.00648,"percentile":0.51514}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-11-11","epss":0.00647,"percentile":0.51477}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-11-11","epss":0.00646,"percentile":0.51427}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67216","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-11-11","epss":0.00645,"percentile":0.51405}],"risk":0.3225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67216"},"relatedVulnerabilities":[{"id":"CVE-2026-67216","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-11-11","epss":0.00645,"percentile":0.51405}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-11","epss":0.0062,"percentile":0.50192}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-11","epss":0.0062,"percentile":0.50192}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-11","epss":0.0062,"percentile":0.50192}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-11-11","epss":0.0062,"percentile":0.50192}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-11-11","epss":0.00619,"percentile":0.50116}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-11","epss":0.00615,"percentile":0.49921}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-11","epss":0.00615,"percentile":0.49921}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-11","epss":0.00615,"percentile":0.49921}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-11-11","epss":0.00615,"percentile":0.49921}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-11","epss":0.00609,"percentile":0.49643}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-11-11","epss":0.00599,"percentile":0.49137}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-11","epss":0.00588,"percentile":0.48571}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-11","epss":0.00588,"percentile":0.48571}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-11-11","epss":0.00586,"percentile":0.48476}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-11-11","epss":0.00586,"percentile":0.48476}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-11-11","epss":0.00583,"percentile":0.48284}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-11-11","epss":0.00583,"percentile":0.48284}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-11-11","epss":0.0058,"percentile":0.48161}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-11-11","epss":0.00578,"percentile":0.48069}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-48965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-11-11","epss":0.00574,"percentile":0.47865}],"risk":0.28700000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48965"},"relatedVulnerabilities":[{"id":"CVE-2025-48965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-11-11","epss":0.00574,"percentile":0.47865}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48965","description":"Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-11","epss":0.00562,"percentile":0.47176}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-11","epss":0.00562,"percentile":0.47176}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-11","epss":0.00562,"percentile":0.47176}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-11-11","epss":0.00562,"percentile":0.47176}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-11","epss":0.00547,"percentile":0.46269}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-11","epss":0.00534,"percentile":0.45557}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"8bc1c8460275f7b9","cpes":["cpe:2.3:a:python3-pkg-resources:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg-resources:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg_resources:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3-pkg:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3_pkg:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pkg-resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pkg_resources:68.1.2-2ubuntu1.2:*:*:*:*:*:*:*"],"name":"python3-pkg-resources","purl":"pkg:deb/ubuntu/python3-pkg-resources@68.1.2-2ubuntu1.2?arch=all&distro=ubuntu-24.04&upstream=setuptools","type":"deb","version":"68.1.2-2ubuntu1.2","language":"","licenses":["Apache-2.0","BSD-3-Clause","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3-pkg-resources/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3-pkg-resources/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3-pkg-resources.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.list"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.postinst"},{"path":"/var/lib/dpkg/info/python3-pkg-resources.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3-pkg-resources.prerm"}],"upstreams":[{"name":"setuptools"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-59890","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"setuptools","version":"68.1.2-2ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-59890","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59890","cwe":"CWE-697","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59890","date":"2026-11-11","epss":0.0053,"percentile":0.45289}],"risk":0.265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-59890"},"relatedVulnerabilities":[{"id":"CVE-2026-59890","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59890","cwe":"CWE-697","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59890","date":"2026-11-11","epss":0.0053,"percentile":0.45289}],"urls":["https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/setuptools/releases/tag/v83.0.0","https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-11","epss":0.00528,"percentile":0.45186}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87933","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-11-11","epss":0.00527,"percentile":0.45107}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87933"},"relatedVulnerabilities":[{"id":"CVE-2026-87933","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-11-11","epss":0.00527,"percentile":0.45107}],"urls":["https://github.com/DaveGamble/cJSON/","https://github.com/DaveGamble/cJSON/issues/1060","https://github.com/DaveGamble/cJSON/pull/1065","https://vuldb.com/cve/CVE-2026-87933","https://vuldb.com/submit/911136","https://vuldb.com/vuln/401815","https://vuldb.com/vuln/401815/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87933","description":"A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-11","epss":0.00526,"percentile":0.4502}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-11","epss":0.00524,"percentile":0.44948}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-11-11","epss":0.00524,"percentile":0.44895}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-11","epss":0.00521,"percentile":0.44695}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-11-11","epss":0.00506,"percentile":0.43689}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-11-11","epss":0.00496,"percentile":0.43046}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-11-11","epss":0.00496,"percentile":0.43002}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-11","epss":0.00494,"percentile":0.42873}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-11","epss":0.00494,"percentile":0.42873}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-11","epss":0.00488,"percentile":0.42456}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-11","epss":0.00472,"percentile":0.41227}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-1000520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-11-11","epss":0.00786,"percentile":0.5657}],"risk":0.23580000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000520"},"relatedVulnerabilities":[{"id":"CVE-2018-1000520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-11-11","epss":0.00786,"percentile":0.5657}],"urls":["https://github.com/ARMmbed/mbedtls/issues/1561"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000520","description":"ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted.."}]},{"artifact":{"id":"944752b806948053","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.13.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15366","versionConstraint":"< 3.13.15||>= 3.14.0, < 3.14.7||>= 3.15.0a1, < 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"fixed","versions":["3.13.15","3.14.7","3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.13.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.7"},{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-08-12","kind":"first-observed","version":"3.13.15"},{"date":"2026-08-12","kind":"first-observed","version":"3.14.7"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"risk":0.234895,"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-11-11","epss":0.00467,"percentile":0.40852}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-11-11","epss":0.0046,"percentile":0.40325}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-11-11","epss":0.0046,"percentile":0.40323}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-11-11","epss":0.0046,"percentile":0.40319}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-11-11","epss":0.0046,"percentile":0.40311}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-11-11","epss":0.0046,"percentile":0.40257}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-11-11","epss":0.00458,"percentile":0.40122}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-11-11","epss":0.00454,"percentile":0.39846}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-11","epss":0.00448,"percentile":0.39394}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-11","epss":0.00448,"percentile":0.39394}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"85460752c3000dd1","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.39-0exp1ubuntu0.24.04.3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.39-0exp1ubuntu0.24.04.3?arch=amd64&distro=ubuntu-24.04&upstream=libxslt","type":"deb","version":"1.1.39-0exp1ubuntu0.24.04.3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7425","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxslt","version":"1.1.39-0exp1ubuntu0.24.04.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7425","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-11-11","epss":0.00444,"percentile":0.39051}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7425"},"relatedVulnerabilities":[{"id":"CVE-2025-7425","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-11-11","epss":0.00444,"percentile":0.39051}],"urls":["https://access.redhat.com/errata/RHBA-2025:12345","https://access.redhat.com/errata/RHSA-2025:12447","https://access.redhat.com/errata/RHSA-2025:12450","https://access.redhat.com/errata/RHSA-2025:13267","https://access.redhat.com/errata/RHSA-2025:13308","https://access.redhat.com/errata/RHSA-2025:13309","https://access.redhat.com/errata/RHSA-2025:13310","https://access.redhat.com/errata/RHSA-2025:13311","https://access.redhat.com/errata/RHSA-2025:13312","https://access.redhat.com/errata/RHSA-2025:13313","https://access.redhat.com/errata/RHSA-2025:13314","https://access.redhat.com/errata/RHSA-2025:13335","https://access.redhat.com/errata/RHSA-2025:13464","https://access.redhat.com/errata/RHSA-2025:13622","https://access.redhat.com/errata/RHSA-2025:14059","https://access.redhat.com/errata/RHSA-2025:14396","https://access.redhat.com/errata/RHSA-2025:14818","https://access.redhat.com/errata/RHSA-2025:14819","https://access.redhat.com/errata/RHSA-2025:14853","https://access.redhat.com/errata/RHSA-2025:14858","https://access.redhat.com/errata/RHSA-2025:15308","https://access.redhat.com/errata/RHSA-2025:15672","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:21913","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/errata/RHSA-2026:11503","https://access.redhat.com/security/cve/CVE-2025-7425","https://bugzilla.redhat.com/show_bug.cgi?id=2379274","https://gitlab.gnome.org/GNOME/libxslt/-/issues/140","http://seclists.org/fulldisclosure/2025/Aug/0","http://seclists.org/fulldisclosure/2025/Jul/30","http://seclists.org/fulldisclosure/2025/Jul/32","http://seclists.org/fulldisclosure/2025/Jul/35","http://seclists.org/fulldisclosure/2025/Jul/37","http://www.openwall.com/lists/oss-security/2025/07/11/2","https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7425","description":"A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-29036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-29036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-11-11","epss":0.00444,"percentile":0.39009}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-29036"},"relatedVulnerabilities":[{"id":"CVE-2026-29036","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-11-11","epss":0.00444,"percentile":0.39009}],"urls":["https://github.com/DaveGamble/cJSON","https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29036","description":"cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-11-11","epss":0.00443,"percentile":0.38971}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34877","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-11-11","epss":0.00442,"percentile":0.38855}],"risk":0.22100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34877"},"relatedVulnerabilities":[{"id":"CVE-2026-34877","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-11-11","epss":0.00442,"percentile":0.38855}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34877","description":"An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-11-11","epss":0.00437,"percentile":0.38407}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-11","epss":0.00726,"percentile":0.5458}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-11-11","epss":0.00433,"percentile":0.37997}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67217"},"relatedVulnerabilities":[{"id":"CVE-2026-67217","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-11-11","epss":0.00433,"percentile":0.37997}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-11-11","epss":0.00433,"percentile":0.37984}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-11-11","epss":0.00433,"percentile":0.37984}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15366"},"relatedVulnerabilities":[{"id":"CVE-2025-15366","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15366","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15366","date":"2026-11-11","epss":0.00431,"percentile":0.37813}],"urls":["https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1","https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45","https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2","https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d","https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a","https://github.com/python/cpython/issues/143921","https://github.com/python/cpython/pull/143922","https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","description":"The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters."}]},{"artifact":{"id":"50a5f90955be3d4b","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/ubuntu/dirmngr@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"a4b63a4bf6a5b600","cpes":["cpe:2.3:a:gnupg:gnupg:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@2.4.4-2ubuntu17.6?arch=all&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"312c3b72c37ce5e0","cpes":["cpe:2.3:a:gnupg-utils:gnupg-utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-utils:gnupg_utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg-utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg_utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_utils:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gnupg-utils","purl":"pkg:deb/ubuntu/gnupg-utils@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-utils/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gnupg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gnupg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gnupg-utils.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"111d86dc48f741d8","cpes":["cpe:2.3:a:gpg:gpg:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/ubuntu/gpg@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"5315a0165ef4e458","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/ubuntu/gpg-agent@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg-agent.list"},{"path":"/var/lib/dpkg/info/gpg-agent.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg-agent.postinst"},{"path":"/var/lib/dpkg/info/gpg-agent.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpg-agent.postrm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"9ff230767a747dbe","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/ubuntu/gpgconf@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"2062e3cd90405dfe","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/ubuntu/gpgsm@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"db9250ad2fb3f819","cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"87b56c9afd975b01","cpes":["cpe:2.3:a:keyboxd:keyboxd:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"keyboxd","purl":"pkg:deb/ubuntu/keyboxd@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/keyboxd/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/keyboxd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/keyboxd.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/keyboxd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/keyboxd.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/keyboxd.list"},{"path":"/var/lib/dpkg/info/keyboxd.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/keyboxd.postinst"},{"path":"/var/lib/dpkg/info/keyboxd.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/keyboxd.postrm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-11","epss":0.0043,"percentile":0.37681}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-11","epss":0.00425,"percentile":0.37263}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-11","epss":0.00425,"percentile":0.37263}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-11","epss":0.00425,"percentile":0.37181}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-11","epss":0.00425,"percentile":0.37181}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-11-11","epss":0.00424,"percentile":0.37173}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61702"},"relatedVulnerabilities":[{"id":"CVE-2026-61702","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-11-11","epss":0.00424,"percentile":0.37173}],"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-11","epss":0.00424,"percentile":0.3716}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-11-11","epss":0.00422,"percentile":0.36999}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-11-11","epss":0.00422,"percentile":0.36946}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6d1f2844cc275151","cpes":["cpe:2.3:a:libspeex1:libspeex1:1.2.1-2ubuntu2.24.04.1:*:*:*:*:*:*:*"],"name":"libspeex1","purl":"pkg:deb/ubuntu/libspeex1@1.2.1-2ubuntu2.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=speex","type":"deb","version":"1.2.1-2ubuntu2.24.04.1","language":"","licenses":["BSD-3-Clause","GFDL-1.1-or-later","GFDL-1.2","LGPL-2","LGPL-2.0-or-later","custom-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libspeex1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libspeex1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libspeex1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libspeex1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"speex"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116741","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"speex","version":"1.2.1-2ubuntu2.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116741","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116741","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116741","date":"2026-11-11","epss":0.00418,"percentile":0.36557}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116741"},"relatedVulnerabilities":[{"id":"CVE-2026-116741","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116741","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116741","date":"2026-11-11","epss":0.00418,"percentile":0.36557}],"urls":["https://github.com/xiph/speex","https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177","https://github.com/xiph/speex/issues/42","https://gitlab.xiph.org/xiph/speex/-/merge_requests/32","https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write","https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes","https://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116741","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-11-11","epss":0.00416,"percentile":0.36345}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-11-11","epss":0.00415,"percentile":0.36279}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-11","epss":0.00413,"percentile":0.35983}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-11","epss":0.00413,"percentile":0.35983}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"944752b806948053","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"fixed","versions":["3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"risk":0.20546500000000004,"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-11-11","epss":0.00406,"percentile":0.35285}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34876"},"relatedVulnerabilities":[{"id":"CVE-2026-34876","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-11-11","epss":0.00406,"percentile":0.35285}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34876","description":"An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API."}]},{"artifact":{"id":"0bf934ad0e4dae4b","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/ubuntu/libgdk-pixbuf-2.0-0@2.42.10%2Bdfsg-3ubuntu3.3?arch=amd64&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-11","epss":0.00405,"percentile":0.35254}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-11","epss":0.00405,"percentile":0.35254}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"b28b3a9e124727ef","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/ubuntu/libgdk-pixbuf2.0-common@2.42.10%2Bdfsg-3ubuntu3.3?arch=all&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-11","epss":0.00405,"percentile":0.35254}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-11-11","epss":0.00405,"percentile":0.35254}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-11-11","epss":0.00401,"percentile":0.34771}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-11-11","epss":0.00396,"percentile":0.34291}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-11-11","epss":0.00396,"percentile":0.34223}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-11","epss":0.00395,"percentile":0.3413}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-11","epss":0.00395,"percentile":0.3413}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-11-11","epss":0.00393,"percentile":0.33951}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-11-11","epss":0.00392,"percentile":0.33787}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87875"},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-11-11","epss":0.00392,"percentile":0.33787}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-11","epss":0.00391,"percentile":0.3368}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-11","epss":0.00391,"percentile":0.3368}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-11-11","epss":0.00391,"percentile":0.33625}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-11-11","epss":0.00384,"percentile":0.32874}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-11-11","epss":0.00377,"percentile":0.3214}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15367"},"relatedVulnerabilities":[{"id":"CVE-2025-15367","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-11-11","epss":0.00377,"percentile":0.321}],"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."}]},{"artifact":{"id":"c63c50e09a049480","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-11","epss":0.00376,"percentile":0.31985}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-11","epss":0.00376,"percentile":0.31985}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"cd1ded1d948407f7","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-11","epss":0.00376,"percentile":0.31985}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-11","epss":0.00376,"percentile":0.31985}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-11-11","epss":0.00374,"percentile":0.31745}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-11","epss":0.00622,"percentile":0.50295}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-11-11","epss":0.00372,"percentile":0.31539}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-11-11","epss":0.00368,"percentile":0.3102}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16554","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-11-11","epss":0.00367,"percentile":0.30934}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16554"},"relatedVulnerabilities":[{"id":"CVE-2026-16554","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-11-11","epss":0.00367,"percentile":0.30934}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-11-11","epss":0.00361,"percentile":0.30244}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-11","epss":0.0036,"percentile":0.30142}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-11","epss":0.00359,"percentile":0.30068}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-11","epss":0.00355,"percentile":0.29635}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-11-11","epss":0.00355,"percentile":0.29577}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-11-11","epss":0.00355,"percentile":0.29577}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-11-11","epss":0.00355,"percentile":0.29576}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107080","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107080","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-107080","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107080","date":"2026-11-11","epss":0.00352,"percentile":0.29275}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107080"},"relatedVulnerabilities":[{"id":"CVE-2026-107080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107080","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-107080","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107080","date":"2026-11-11","epss":0.00352,"percentile":0.29275}],"urls":["https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33","https://github.com/uclouvain/openjpeg/issues/1673","https://github.com/uclouvain/openjpeg/pull/1674","https://www.openwall.com/lists/oss-security/2026/10/05/5","http://www.openwall.com/lists/oss-security/2026/10/24/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107080","description":"OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-11-11","epss":0.00352,"percentile":0.29237}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-11-11","epss":0.0035,"percentile":0.29052}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-11-11","epss":0.0035,"percentile":0.29016}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-11","epss":0.00348,"percentile":0.28808}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-11","epss":0.00348,"percentile":0.28808}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-11-11","epss":0.00348,"percentile":0.28719}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-11-11","epss":0.00344,"percentile":0.28314}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-11","epss":0.00344,"percentile":0.28287}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-11-11","epss":0.00335,"percentile":0.27166}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-11-11","epss":0.00332,"percentile":0.26704}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-11","epss":0.03312,"percentile":0.88719}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-11","epss":0.03312,"percentile":0.88719}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-11","epss":0.03312,"percentile":0.88719}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-11-11","epss":0.03312,"percentile":0.88719}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52497","cwe":"CWE-193","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-52497","date":"2026-11-11","epss":0.00331,"percentile":0.26621}],"risk":0.1655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52497"},"relatedVulnerabilities":[{"id":"CVE-2025-52497","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52497","cwe":"CWE-193","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-52497","date":"2026-11-11","epss":0.00331,"percentile":0.26621}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-2.md","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52497","description":"Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-11","epss":0.0033,"percentile":0.2651}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-11","epss":0.0033,"percentile":0.2651}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-11-11","epss":0.00328,"percentile":0.26196}],"risk":0.164,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87876"},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-11-11","epss":0.00328,"percentile":0.26196}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25833","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-11-11","epss":0.0032,"percentile":0.25285}],"risk":0.16,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25833"},"relatedVulnerabilities":[{"id":"CVE-2026-25833","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-11-11","epss":0.0032,"percentile":0.25285}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25833","description":"Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-11-11","epss":0.00319,"percentile":0.25241}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-11-11","epss":0.00307,"percentile":0.23801}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-11","epss":0.00297,"percentile":0.22662}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-11","epss":0.00297,"percentile":0.22662}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-11","epss":0.00297,"percentile":0.22662}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-11","epss":0.00297,"percentile":0.22662}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-27810","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-27810","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-27810","cwe":"CWE-908","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-27810","date":"2026-11-11","epss":0.00297,"percentile":0.22599}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-27810"},"relatedVulnerabilities":[{"id":"CVE-2025-27810","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27810","cwe":"CWE-908","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-27810","date":"2026-11-11","epss":0.00297,"percentile":0.22599}],"urls":["https://github.com/Mbed-TLS/mbedtls/releases","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27810","description":"Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-11-11","epss":0.00294,"percentile":0.2225}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-11-11","epss":0.00294,"percentile":0.2225}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-11-11","epss":0.00293,"percentile":0.22192}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34874","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-11-11","epss":0.0029,"percentile":0.21782}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34874"},"relatedVulnerabilities":[{"id":"CVE-2026-34874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-11-11","epss":0.0029,"percentile":0.21782}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34874","description":"An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25832","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-25832","date":"2026-11-11","epss":0.00282,"percentile":0.20921}],"risk":0.14100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25832"},"relatedVulnerabilities":[{"id":"CVE-2026-25832","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25832","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-25832","date":"2026-11-11","epss":0.00282,"percentile":0.20921}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25832","description":"In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-11","epss":0.00281,"percentile":0.20834}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-11","epss":0.00281,"percentile":0.20834}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-11","epss":0.00281,"percentile":0.20834}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-11","epss":0.00281,"percentile":0.20834}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66442","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66442","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66442","cwe":"CWE-385","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66442","date":"2026-11-11","epss":0.0028,"percentile":0.20753}],"risk":0.13999999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66442"},"relatedVulnerabilities":[{"id":"CVE-2025-66442","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66442","cwe":"CWE-385","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-66442","date":"2026-11-11","epss":0.0028,"percentile":0.20753}],"urls":["https://github.com/Mbed-TLS/TF-PSA-Crypto/releases","https://github.com/Mbed-TLS/mbedtls/releases","https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66442","description":"In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected."}]},{"artifact":{"id":"077b27b180a9ce9b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.8?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-11","epss":0.00278,"percentile":0.20506}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119379"},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-11","epss":0.00278,"percentile":0.20506}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-53154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-53154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-53154","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53154","date":"2026-11-11","epss":0.00278,"percentile":0.20481}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-53154"},"relatedVulnerabilities":[{"id":"CVE-2023-53154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-53154","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-53154","date":"2026-11-11","epss":0.00278,"percentile":0.20481}],"urls":["https://github.com/DaveGamble/cJSON/compare/v1.7.17...v1.7.18","https://github.com/DaveGamble/cJSON/issues/800","https://lists.debian.org/debian-lts-announce/2025/06/msg00014.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-53154","description":"parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {\"1\":1, with no trailing newline if cJSON_ParseWithLength is called."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-11-11","epss":0.00277,"percentile":0.20319}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"risk":0.13799999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120210"},"relatedVulnerabilities":[{"id":"CVE-2026-120210","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-11","epss":0.00276,"percentile":0.2025}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."}]},{"artifact":{"id":"c3005cb1b8d81dce","cpes":["cpe:2.3:a:libharfbuzz0b:libharfbuzz0b:8.3.0-2build2:*:*:*:*:*:*:*"],"name":"libharfbuzz0b","purl":"pkg:deb/ubuntu/libharfbuzz0b@8.3.0-2build2?arch=amd64&distro=ubuntu-24.04&upstream=harfbuzz","type":"deb","version":"8.3.0-2build2","language":"","licenses":["Apache-2.0","CC0-1.0","Expat","FSFAP","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","MIT","Monotype","OFL-1.1","UFL-1.0","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libharfbuzz0b/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libharfbuzz0b/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"harfbuzz"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"harfbuzz","version":"8.3.0-2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-22693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-11-11","epss":0.00452,"percentile":0.39689}],"risk":0.13559999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-22693"},"relatedVulnerabilities":[{"id":"CVE-2026-22693","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-11-11","epss":0.00452,"percentile":0.39689}],"urls":["https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae","https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww","http://www.openwall.com/lists/oss-security/2026/01/11/1","http://www.openwall.com/lists/oss-security/2026/01/12/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22693","description":"HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."}]},{"artifact":{"id":"02a955a1796261b8","cpes":["cpe:2.3:a:libtesseract5:libtesseract5:5.3.4-1build5:*:*:*:*:*:*:*"],"name":"libtesseract5","purl":"pkg:deb/ubuntu/libtesseract5@5.3.4-1build5?arch=amd64&distro=ubuntu-24.04&upstream=tesseract","type":"deb","version":"5.3.4-1build5","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtesseract5/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libtesseract5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtesseract5:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libtesseract5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tesseract"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119341","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tesseract","version":"5.3.4-1build5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119341","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-11","epss":0.0027,"percentile":0.19405}],"risk":0.135,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119341"},"relatedVulnerabilities":[{"id":"CVE-2026-119341","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"impactScore":0,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-11","epss":0.0027,"percentile":0.19405}],"urls":["https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23","https://github.com/tesseract-ocr/tesseract/pull/4645","https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119341","description":"Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4."}]},{"artifact":{"id":"6d352b2fd462459b","cpes":["cpe:2.3:a:tesseract-ocr:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract_ocr:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract_ocr:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract:tesseract-ocr:5.3.4-1build5:*:*:*:*:*:*:*","cpe:2.3:a:tesseract:tesseract_ocr:5.3.4-1build5:*:*:*:*:*:*:*"],"name":"tesseract-ocr","purl":"pkg:deb/ubuntu/tesseract-ocr@5.3.4-1build5?arch=amd64&distro=ubuntu-24.04&upstream=tesseract","type":"deb","version":"5.3.4-1build5","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tesseract-ocr/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/tesseract-ocr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tesseract-ocr.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/tesseract-ocr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tesseract-ocr.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/tesseract-ocr.list"}],"upstreams":[{"name":"tesseract"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119341","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tesseract","version":"5.3.4-1build5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119341","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-11","epss":0.0027,"percentile":0.19405}],"risk":0.135,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119341"},"relatedVulnerabilities":[{"id":"CVE-2026-119341","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"impactScore":0,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119341","cwe":"CWE-763","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-119341","date":"2026-11-11","epss":0.0027,"percentile":0.19405}],"urls":["https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23","https://github.com/tesseract-ocr/tesseract/pull/4645","https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119341","description":"Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-11","epss":0.00269,"percentile":0.19216}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-11","epss":0.00269,"percentile":0.19216}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-11-11","epss":0.00268,"percentile":0.19072}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-11-11","epss":0.00268,"percentile":0.19072}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"944752b806948053","cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.12.16","type":"binary","version":"3.12.16","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.12","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/bin/python3.12","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.12.so.1.0","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/local/lib/libpython3.12.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.16.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-116566","versionConstraint":"< 3.16.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.16.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-116566","versionConstraint":"< 3.16.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.12.16:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.12.16"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"fixed","versions":["3.16.0"],"available":[{"date":"2026-11-05","kind":"first-observed","version":"3.16.0"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"risk":0.133385,"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."},"relatedVulnerabilities":[]},{"artifact":{"id":"d89ef5f93ba22208","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dbc0224a08459408","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"8213e07a58a8ec78","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"16e6be2ba255a19b","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-11","epss":0.00265,"percentile":0.18583}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59438","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-59438","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-59438","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-59438","date":"2026-11-11","epss":0.00264,"percentile":0.18377}],"risk":0.132,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-59438"},"relatedVulnerabilities":[{"id":"CVE-2025-59438","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59438","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-59438","date":"2026-11-11","epss":0.00264,"percentile":0.18377}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error/","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59438","description":"Mbed TLS through 3.6.4 has an Observable Timing Discrepancy."}]},{"artifact":{"id":"9399a526f720c3e2","cpes":["cpe:2.3:a:libicu74:libicu74:74.2-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"libicu74","purl":"pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu","type":"deb","version":"74.2-1ubuntu3.1","language":"","licenses":["GPL-3","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu74/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libicu74/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu74:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libicu74:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"icu","version":"74.2-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5222","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-11-11","epss":0.00439,"percentile":0.38579}],"risk":0.13169999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5222"},"relatedVulnerabilities":[{"id":"CVE-2025-5222","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-11-11","epss":0.00439,"percentile":0.38579}],"urls":["https://access.redhat.com/errata/RHSA-2025:11888","https://access.redhat.com/errata/RHSA-2025:12083","https://access.redhat.com/errata/RHSA-2025:12331","https://access.redhat.com/errata/RHSA-2025:12332","https://access.redhat.com/errata/RHSA-2025:12333","https://access.redhat.com/errata/RHSA-2026:54544","https://access.redhat.com/errata/RHSA-2026:54553","https://access.redhat.com/errata/RHSA-2026:54581","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/security/cve/CVE-2025-5222","https://bugzilla.redhat.com/show_bug.cgi?id=2368600","https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957","https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5222","description":"A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution."}]},{"artifact":{"id":"995fe9e99f20c9b6","cpes":["cpe:2.3:a:libxrender1:libxrender1:1\\:0.9.10-1.1build1:*:*:*:*:*:*:*"],"name":"libxrender1","purl":"pkg:deb/ubuntu/libxrender1@1%3A0.9.10-1.1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxrender","type":"deb","version":"1:0.9.10-1.1build1","language":"","licenses":["HPND-sell-variant"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxrender1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libxrender1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxrender"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxrender","version":"1:0.9.10-1.1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-11-11","epss":0.00263,"percentile":0.1829}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88807"},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-11-11","epss":0.00263,"percentile":0.1829}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-11-11","epss":0.00261,"percentile":0.18093}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-11","epss":0.00261,"percentile":0.18081}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107655","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107655","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-11-11","epss":0.0026,"percentile":0.17912}],"risk":0.13,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107655"},"relatedVulnerabilities":[{"id":"CVE-2026-107655","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-11-11","epss":0.0026,"percentile":0.17912}],"urls":["https://access.redhat.com/errata/RHSA-2026:80679","https://access.redhat.com/security/cve/CVE-2026-107655","https://bugzilla.redhat.com/show_bug.cgi?id=2548399","https://github.com/OpenPrinting/cups/commit/12237ad","https://github.com/OpenPrinting/cups/commit/25d6830","https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-11","epss":0.00259,"percentile":0.17791}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-11-11","epss":0.00258,"percentile":0.1763}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"cd80a8862611238d","cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.3:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"9.4-3ubuntu6.3","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-11","epss":0.00428,"percentile":0.37497}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-11","epss":0.00428,"percentile":0.37497}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"271cbc4b0386e5d1","cpes":["cpe:2.3:a:login:login:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-11","epss":0.00426,"percentile":0.37347}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-11","epss":0.00426,"percentile":0.37347}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"12ce9c7a4baa2c69","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-11","epss":0.00426,"percentile":0.37347}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-11","epss":0.00426,"percentile":0.37347}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84366"},"relatedVulnerabilities":[{"id":"CVE-2026-84366","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"urls":["https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b","https://github.com/scrapy/scrapy/releases/tag/2.17.0","https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84366","description":"Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84366"},"relatedVulnerabilities":[{"id":"CVE-2026-84366","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"urls":["https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b","https://github.com/scrapy/scrapy/releases/tag/2.17.0","https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84366","description":"Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84366"},"relatedVulnerabilities":[{"id":"CVE-2026-84366","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"urls":["https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b","https://github.com/scrapy/scrapy/releases/tag/2.17.0","https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84366","description":"Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84366"},"relatedVulnerabilities":[{"id":"CVE-2026-84366","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-11","epss":0.00254,"percentile":0.17182}],"urls":["https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b","https://github.com/scrapy/scrapy/releases/tag/2.17.0","https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84366","description":"Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0."}]},{"artifact":{"id":"077b27b180a9ce9b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.8?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-11","epss":0.00251,"percentile":0.16582}],"risk":0.1255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119378"},"relatedVulnerabilities":[{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-11","epss":0.00251,"percentile":0.16582}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34873","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34873","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34873","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34873","date":"2026-11-11","epss":0.00251,"percentile":0.16575}],"risk":0.1255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34873"},"relatedVulnerabilities":[{"id":"CVE-2026-34873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34873","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34873","date":"2026-11-11","epss":0.00251,"percentile":0.16575}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34873","description":"An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124317","cwe":"CWE-126","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-124317","date":"2026-11-11","epss":0.00249,"percentile":0.16312}],"risk":0.1245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124317"},"relatedVulnerabilities":[{"id":"CVE-2026-124317","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124317","cwe":"CWE-126","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-124317","date":"2026-11-11","epss":0.00249,"percentile":0.16312}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.c#L1274-L1322","https://github.com/libexpat/libexpat/pull/1492","https://www.vulncheck.com/advisories/libexpat-through-2.10.0-out-of-bounds-read-via-unknown-toutf8-and-unknown-toutf16"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124317","description":"libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-11-11","epss":0.00247,"percentile":0.16178}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.42-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 10.42-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"fixed","versions":["10.42-4ubuntu2.2"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.42-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-11","epss":0.00247,"percentile":0.16096}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89158"},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-11","epss":0.00247,"percentile":0.16096}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-11-11","epss":0.00246,"percentile":0.16033}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39328","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-11-11","epss":0.00242,"percentile":0.15552}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39328"},"relatedVulnerabilities":[{"id":"CVE-2023-39328","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-11-11","epss":0.00242,"percentile":0.15552}],"urls":["https://access.redhat.com/security/cve/CVE-2023-39328","https://bugzilla.redhat.com/show_bug.cgi?id=2219236","https://github.com/uclouvain/openjpeg/issues/1476","https://github.com/uclouvain/openjpeg/pull/1470","https://github.com/uclouvain/openjpeg/pull/1471"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39328","description":"A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-11-11","epss":0.00242,"percentile":0.15502}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-11-11","epss":0.00242,"percentile":0.15453}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-11-11","epss":0.00241,"percentile":0.15395}],"risk":0.1205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107886"},"relatedVulnerabilities":[{"id":"CVE-2026-107886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-11-11","epss":0.00241,"percentile":0.15395}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."}]},{"artifact":{"id":"b90fee4deeefe7ab","cpes":["cpe:2.3:a:libzbar0t64:libzbar0t64:0.23.93-4build3:*:*:*:*:*:*:*"],"name":"libzbar0t64","purl":"pkg:deb/ubuntu/libzbar0t64@0.23.93-4build3?arch=amd64&distro=ubuntu-24.04&upstream=zbar","type":"deb","version":"0.23.93-4build3","language":"","licenses":["sha256:a98c05965c42a5711075ddf2c88d17042898ed528e790c220bdf4c81f6ea127d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzbar0t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libzbar0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzbar0t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libzbar0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zbar"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121942","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zbar","version":"0.23.93-4build3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-121942","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-121942","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-121942","date":"2026-11-11","epss":0.0024,"percentile":0.1526}],"risk":0.12,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-121942"},"relatedVulnerabilities":[{"id":"CVE-2026-121942","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121942","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-121942","date":"2026-11-11","epss":0.0024,"percentile":0.1526}],"urls":["https://github.com/mchehab/zbar/blob/0.23.95/zbar/sqcode.c#L529-L567","https://github.com/mchehab/zbar/issues/351","https://hackmd.io/@haindpwn/zbar-sqcode-sampling-oob-read","https://www.vulncheck.com/advisories/zbar-through-0.23.95-out-of-bounds-read-via-zbar-sq-decode-in-sqcode-c","https://hackmd.io/@haindpwn/cve-2026-121942-zbar-sqcode-sampling-oob-read"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121942","description":"ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output."}]},{"artifact":{"id":"ae131b98004256cd","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","type":"deb","version":"3.8.3-1.1ubuntu3.6","language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88647","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-11","epss":0.0024,"percentile":0.15202}],"risk":0.12,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88647"},"relatedVulnerabilities":[{"id":"CVE-2026-88647","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-11","epss":0.0024,"percentile":0.15202}],"urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/issues/1802","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-88647"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"55a74c0a3567b049","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:deb/ubuntu/ghostscript@10.02.1~dfsg1-0ubuntu7.10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"10.02.1~dfsg1-0ubuntu7.10","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ghostscript/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/ghostscript/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/ghostscript.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ghostscript.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/ghostscript.list"},{"path":"/var/lib/dpkg/info/ghostscript.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/ghostscript.postinst"},{"path":"/var/lib/dpkg/info/ghostscript.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/ghostscript.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ghostscript","version":"10.02.1~dfsg1-0ubuntu7.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-110133","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"risk":0.11750000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-110133"},"relatedVulnerabilities":[{"id":"CVE-2026-110133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":5.2,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"urls":["https://access.redhat.com/security/cve/CVE-2026-110133","https://bugzilla.redhat.com/show_bug.cgi?id=2461973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110133","description":"A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution."}]},{"artifact":{"id":"3897a4694530881a","cpes":["cpe:2.3:a:libgs-common:libgs-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs-common:libgs_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs_common:libgs_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs:libgs_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*"],"name":"libgs-common","purl":"pkg:deb/ubuntu/libgs-common@10.02.1~dfsg1-0ubuntu7.10?arch=all&distro=ubuntu-24.04&upstream=ghostscript","type":"deb","version":"10.02.1~dfsg1-0ubuntu7.10","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgs-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgs-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgs-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ghostscript","version":"10.02.1~dfsg1-0ubuntu7.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-110133","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"risk":0.11750000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-110133"},"relatedVulnerabilities":[{"id":"CVE-2026-110133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":5.2,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"urls":["https://access.redhat.com/security/cve/CVE-2026-110133","https://bugzilla.redhat.com/show_bug.cgi?id=2461973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110133","description":"A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution."}]},{"artifact":{"id":"759ee3c500540541","cpes":["cpe:2.3:a:libgs10:libgs10:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*"],"name":"libgs10","purl":"pkg:deb/ubuntu/libgs10@10.02.1~dfsg1-0ubuntu7.10?arch=amd64&distro=ubuntu-24.04&upstream=ghostscript","type":"deb","version":"10.02.1~dfsg1-0ubuntu7.10","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgs10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgs10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ghostscript","version":"10.02.1~dfsg1-0ubuntu7.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-110133","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"risk":0.11750000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-110133"},"relatedVulnerabilities":[{"id":"CVE-2026-110133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":5.2,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"urls":["https://access.redhat.com/security/cve/CVE-2026-110133","https://bugzilla.redhat.com/show_bug.cgi?id=2461973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110133","description":"A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution."}]},{"artifact":{"id":"3e8c00e8c607b244","cpes":["cpe:2.3:a:libgs10-common:libgs10-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs10-common:libgs10_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs10_common:libgs10_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10-common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*","cpe:2.3:a:libgs10:libgs10_common:10.02.1\\~dfsg1-0ubuntu7.10:*:*:*:*:*:*:*"],"name":"libgs10-common","purl":"pkg:deb/ubuntu/libgs10-common@10.02.1~dfsg1-0ubuntu7.10?arch=all&distro=ubuntu-24.04&upstream=ghostscript","type":"deb","version":"10.02.1~dfsg1-0ubuntu7.10","language":"","licenses":["AGPL-3","AGPL-3+","Apache-2.0","BSD-3-Clause","BSD-3-Clause~Adobe","Expat","Expat~Ghostgum","Expat~SunSoft","FTL","GAP~configure","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","MIT-Open-Group","NTP~Lucent","NTP~WSU","X11","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgs10-common/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libgs10-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgs10-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgs10-common.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libgs10-common.list"}],"upstreams":[{"name":"ghostscript"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110133","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ghostscript","version":"10.02.1~dfsg1-0ubuntu7.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-110133","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"risk":0.11750000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-110133"},"relatedVulnerabilities":[{"id":"CVE-2026-110133","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":5.2,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110133","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-110133","date":"2026-11-11","epss":0.00235,"percentile":0.14547}],"urls":["https://access.redhat.com/security/cve/CVE-2026-110133","https://bugzilla.redhat.com/show_bug.cgi?id=2461973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110133","description":"A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-26819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-26819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-26819","cwe":"CWE-440","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-26819","date":"2026-11-11","epss":0.00234,"percentile":0.14471}],"risk":0.117,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-26819"},"relatedVulnerabilities":[{"id":"CVE-2023-26819","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-26819","cwe":"CWE-440","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-26819","date":"2026-11-11","epss":0.00234,"percentile":0.14471}],"urls":["https://github.com/boofish/json_bugs/tree/main/cjson","https://lists.debian.org/debian-lts-announce/2025/06/msg00014.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26819","description":"cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}."}]},{"artifact":{"id":"077b27b180a9ce9b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.8?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-11","epss":0.0023,"percentile":0.1398}],"risk":0.11499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119374"},"relatedVulnerabilities":[{"id":"CVE-2026-119374","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-11","epss":0.0023,"percentile":0.1398}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."}]},{"artifact":{"id":"f7eca80653a08715","cpes":["cpe:2.3:a:libjxl0.7:libjxl0.7:0.7.0-10.2ubuntu6.1:*:*:*:*:*:*:*"],"name":"libjxl0.7","purl":"pkg:deb/ubuntu/libjxl0.7@0.7.0-10.2ubuntu6.1?arch=amd64&distro=ubuntu-24.04&upstream=jpeg-xl","type":"deb","version":"0.7.0-10.2ubuntu6.1","language":"","licenses":["BSD-3-clause-Google","ISC-License"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjxl0.7/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libjxl0.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"jpeg-xl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"jpeg-xl","version":"0.7.0-10.2ubuntu6.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-11-11","epss":0.0023,"percentile":0.13973}],"risk":0.11499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82522"},"relatedVulnerabilities":[{"id":"CVE-2026-82522","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-11-11","epss":0.0023,"percentile":0.13973}],"urls":["https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68","https://github.com/libjxl/libjxl/pull/4885","https://github.com/libjxl/libjxl/releases/tag/v0.12.0","https://www.vulncheck.com/advisories/libjxl-container-box-parser-integer-underflow-via-32-bit-size-truncation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82522","description":"libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105326","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-105326","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-11-11","epss":0.0023,"percentile":0.13945}],"risk":0.11499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105326"},"relatedVulnerabilities":[{"id":"CVE-2026-105326","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105326","cwe":"CWE-88","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-105326","date":"2026-11-11","epss":0.0023,"percentile":0.13945}],"urls":["https://access.redhat.com/errata/RHSA-2026:77638","https://access.redhat.com/security/cve/CVE-2026-105326","https://bugzilla.redhat.com/show_bug.cgi?id=2545835","https://github.com/OpenPrinting/cups/commit/1244ed9","https://github.com/OpenPrinting/cups/commit/611d1bd","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105326","description":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}]},{"artifact":{"id":"4b40fd420b47c163","cpes":["cpe:2.3:a:libpython3.12-minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_minimal:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-minimal","purl":"pkg:deb/ubuntu/libpython3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57175"},"relatedVulnerabilities":[{"id":"CVE-2026-57175","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.4,"impactScore":5.2,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57175","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}]},{"artifact":{"id":"dbe12549c4bf670f","cpes":["cpe:2.3:a:libpython3.12-stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12-stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12_stdlib:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12-stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.12:libpython3.12_stdlib:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"libpython3.12-stdlib","purl":"pkg:deb/ubuntu/libpython3.12-stdlib@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libpython3.12-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libpython3.12-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57175"},"relatedVulnerabilities":[{"id":"CVE-2026-57175","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.4,"impactScore":5.2,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57175","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}]},{"artifact":{"id":"793834de357c34b2","cpes":["cpe:2.3:a:python3.12:python3.12:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.list"},{"path":"/var/lib/dpkg/info/python3.12.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.postinst"},{"path":"/var/lib/dpkg/info/python3.12.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57175"},"relatedVulnerabilities":[{"id":"CVE-2026-57175","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.4,"impactScore":5.2,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57175","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}]},{"artifact":{"id":"f13475867b621878","cpes":["cpe:2.3:a:python3.12-minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12-minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12_minimal:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12-minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*","cpe:2.3:a:python3.12:python3.12_minimal:3.12.3-1ubuntu0.17:*:*:*:*:*:*:*"],"name":"python3.12-minimal","purl":"pkg:deb/ubuntu/python3.12-minimal@3.12.3-1ubuntu0.17?arch=amd64&distro=ubuntu-24.04&upstream=python3.12","type":"deb","version":"3.12.3-1ubuntu0.17","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.12-minimal/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/python3.12-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.12-minimal.list","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.list"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.postrm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.12-minimal.preinst","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.12-minimal.prerm","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/python3.12-minimal.prerm"}],"upstreams":[{"name":"python3.12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"python3.12","version":"3.12.3-1ubuntu0.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57175"},"relatedVulnerabilities":[{"id":"CVE-2026-57175","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.4,"impactScore":5.2,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-11","epss":0.00228,"percentile":0.13666}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57175","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-11","epss":0.00228,"percentile":0.13665}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70632"},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-11","epss":0.00228,"percentile":0.13665}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:dd948b7b17aceff38bf3f4837bbf679290d4363a033543ae279dce3aebd8e007","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70632","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-11","epss":0.00228,"percentile":0.13665}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70632"},"relatedVulnerabilities":[{"id":"CVE-2026-70632","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-11","epss":0.00228,"percentile":0.13665}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."}]}],"grade":"F","score":"0.00","as_of":"2026-11-13T02:36:45.154Z","grype_db_version":"2026-11-12T06:20:58.000Z"}