{"grype_matches":[{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j7hp-h8jx-5ppr","versionConstraint":"<10.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j7hp-h8jx-5ppr","fix":{"state":"fixed","versions":["10.0.1"],"available":[{"date":"2023-10-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4863","date":"2026-10-08","epss":0.99979,"percentile":0.9998}],"risk":85.57500000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-4863","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","https://crbug.com/1479274","https://github.com/qnighy/libwebp-sys2-rs/pull/21","https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b","https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a","https://bugzilla.suse.com/show_bug.cgi?id=1215231","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863","https://news.ycombinator.com/item?id=37478403","https://rustsec.org/advisories/RUSTSEC-2023-0060.html","https://security-tracker.debian.org/tracker/CVE-2023-4863","https://github.com/electron/electron/pull/39823","https://github.com/electron/electron/pull/39825","https://github.com/electron/electron/pull/39826","https://github.com/electron/electron/pull/39827","https://github.com/electron/electron/pull/39828","https://github.com/webmproject/libwebp/releases/tag/v1.3.2","https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html","https://rustsec.org/advisories/RUSTSEC-2023-0061.html","https://security.gentoo.org/glsa/202309-05","https://www.debian.org/security/2023/dsa-5496","https://www.debian.org/security/2023/dsa-5497","https://www.debian.org/security/2023/dsa-5498","http://www.openwall.com/lists/oss-security/2023/09/21/4","http://www.openwall.com/lists/oss-security/2023/09/22/1","http://www.openwall.com/lists/oss-security/2023/09/22/3","http://www.openwall.com/lists/oss-security/2023/09/22/4","http://www.openwall.com/lists/oss-security/2023/09/22/5","http://www.openwall.com/lists/oss-security/2023/09/22/6","http://www.openwall.com/lists/oss-security/2023/09/22/7","http://www.openwall.com/lists/oss-security/2023/09/22/8","http://www.openwall.com/lists/oss-security/2023/09/26/1","http://www.openwall.com/lists/oss-security/2023/09/26/7","http://www.openwall.com/lists/oss-security/2023/09/28/1","http://www.openwall.com/lists/oss-security/2023/09/28/2","http://www.openwall.com/lists/oss-security/2023/09/28/4","https://github.com/jaredforth/webp/pull/30","https://github.com/python-pillow/Pillow/pull/7395","https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc","https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security","https://github.com/ImageMagick/ImageMagick/discussions/6664","https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0","https://security.gentoo.org/glsa/202401-10","https://sethmlarson.dev/security-developer-in-residence-weekly-report-16","https://security.netapp.com/advisory/ntap-20230929-0011","https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863","https://www.bentley.com/advisories/be-2023-0001","https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks","https://www.mozilla.org/en-US/security/advisories/mfsa2023-40","https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863","https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway","https://blog.isosceles.com/the-webp-0day","https://en.bandisoft.com/honeyview/history","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j7hp-h8jx-5ppr","description":"libwebp: OOB write in BuildHuffmanTable","knownExploited":[{"cve":"CVE-2023-4863","cwes":["CWE-787"],"urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1","https://nvd.nist.gov/vuln/detail/CVE-2023-4863"],"dueDate":"2023-10-04","product":"Chromium WebP","dateAdded":"2023-09-13","vendorProject":"Google","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2023-4863","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-4863","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-4863","date":"2026-10-08","epss":0.99979,"percentile":0.9998}],"urls":["http://www.openwall.com/lists/oss-security/2023/09/21/4","http://www.openwall.com/lists/oss-security/2023/09/22/1","http://www.openwall.com/lists/oss-security/2023/09/22/3","http://www.openwall.com/lists/oss-security/2023/09/22/4","http://www.openwall.com/lists/oss-security/2023/09/22/5","http://www.openwall.com/lists/oss-security/2023/09/22/6","http://www.openwall.com/lists/oss-security/2023/09/22/7","http://www.openwall.com/lists/oss-security/2023/09/22/8","http://www.openwall.com/lists/oss-security/2023/09/26/1","http://www.openwall.com/lists/oss-security/2023/09/26/7","http://www.openwall.com/lists/oss-security/2023/09/28/1","http://www.openwall.com/lists/oss-security/2023/09/28/2","http://www.openwall.com/lists/oss-security/2023/09/28/4","https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/","https://blog.isosceles.com/the-webp-0day/","https://bugzilla.suse.com/show_bug.cgi?id=1215231","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","https://crbug.com/1479274","https://en.bandisoft.com/honeyview/history/","https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a","https://github.com/webmproject/libwebp/releases/tag/v1.3.2","https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863","https://news.ycombinator.com/item?id=37478403","https://security-tracker.debian.org/tracker/CVE-2023-4863","https://security.gentoo.org/glsa/202309-05","https://security.gentoo.org/glsa/202401-10","https://security.netapp.com/advisory/ntap-20230929-0011/","https://sethmlarson.dev/security-developer-in-residence-weekly-report-16","https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/","https://www.bentley.com/advisories/be-2023-0001/","https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/","https://www.debian.org/security/2023/dsa-5496","https://www.debian.org/security/2023/dsa-5497","https://www.debian.org/security/2023/dsa-5498","https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/","https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","description":"Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","knownExploited":[{"cve":"CVE-2023-4863","cwes":["CWE-787"],"urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1","https://nvd.nist.gov/vuln/detail/CVE-2023-4863"],"dueDate":"2023-10-04","product":"Chromium WebP","dateAdded":"2023-09-13","vendorProject":"Google","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:2.1.4-2.1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-08","epss":0.97356,"percentile":0.99898}],"risk":73.017,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-08","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:2.1.4-2.1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-08","epss":0.97356,"percentile":0.99898}],"risk":73.017,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-08","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.11.28"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hmr4-m2h5-33qx","versionConstraint":"<1.11.28 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hmr4-m2h5-33qx","fix":{"state":"fixed","versions":["1.11.28"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.11.28"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7471","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7471","date":"2026-10-08","epss":0.65575,"percentile":0.99249}],"risk":60.82081250000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7471","https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136","https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI","https://www.openwall.com/lists/oss-security/2020/02/03/1","http://www.openwall.com/lists/oss-security/2020/02/03/1","https://seclists.org/bugtraq/2020/Feb/30","https://security.gentoo.org/glsa/202004-17","https://www.debian.org/security/2020/dsa-4629","https://github.com/django/django/commit/001b0634cd309e372edb6d7d95d083d02b8e37bd","https://github.com/django/django/commit/505826b469b16ab36693360da9e11fd13213421b","https://github.com/django/django/commit/c67a368c16e4680b324b4f385398d638db4d8147","https://www.djangoproject.com/weblog/2020/feb/03/security-releases","https://usn.ubuntu.com/4264-1","https://security.netapp.com/advisory/ntap-20200221-0006","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-35.yaml","https://docs.djangoproject.com/en/3.0/releases/security"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hmr4-m2h5-33qx","description":"SQL injection in Django"},"relatedVulnerabilities":[{"id":"CVE-2020-7471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7471","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7471","date":"2026-10-08","epss":0.65575,"percentile":0.99249}],"urls":["http://www.openwall.com/lists/oss-security/2020/02/03/1","https://docs.djangoproject.com/en/3.0/releases/security/","https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136","https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/","https://seclists.org/bugtraq/2020/Feb/30","https://security.gentoo.org/glsa/202004-17","https://security.netapp.com/advisory/ntap-20200221-0006/","https://usn.ubuntu.com/4264-1/","https://www.debian.org/security/2020/dsa-4629","https://www.djangoproject.com/weblog/2020/feb/03/security-releases/","https://www.openwall.com/lists/oss-security/2020/02/03/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7471","description":"Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL."}]},{"artifact":{"id":"46d2cbf2678b7c07","cpes":["cpe:2.3:a:inetutils-ping:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils-ping:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils_ping:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils_ping:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*"],"name":"inetutils-ping","purl":"pkg:deb/debian/inetutils-ping@2%3A1.9.2.39.3a460-3?arch=amd64&distro=debian-8.9&upstream=inetutils","type":"deb","version":"2:1.9.2.39.3a460-3","language":"","licenses":["BSD-3-clause","GFDL-1.3","GFDL-1.3+","GPL-3","GPL-3+","MIT","Wietse"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/inetutils-ping/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/inetutils-ping/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/inetutils-ping.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/inetutils-ping.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/inetutils-ping.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/inetutils-ping.list"}],"upstreams":[{"name":"inetutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.9.2.39.3a460-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10188","versionConstraint":"< 2:1.9.2.39.3a460-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"inetutils","version":"2:1.9.2.39.3a460-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10188","fix":{"state":"fixed","versions":["2:1.9.2.39.3a460-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.9.2.39.3a460-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-10188","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10188","date":"2026-10-08","epss":0.74339,"percentile":0.99482}],"risk":55.754250000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10188"},"relatedVulnerabilities":[{"id":"CVE-2020-10188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10188","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10188","date":"2026-10-08","epss":0.74339,"percentile":0.99482}],"urls":["https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html","https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216","https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLU6FL24BSQQEB2SJC26NLJ2MANQDA7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3VJ6V2Z3JRNJOBVHSOPMAC76PSSKG6A/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telnetd-EFJrEzPx","https://www.arista.com/en/support/advisories-notices/security-advisories/10702-security-advisory-48","https://www.oracle.com/security-alerts/cpuApr2021.html","http://www.openwall.com/lists/oss-security/2026/01/20/8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10188","description":"utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions."}]},{"artifact":{"id":"8d57403d1363ac3e","cpes":["cpe:2.3:a:unbit_project:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:uwsgi:2.0.15:*:*:*:*:*:*:*"],"name":"uwsgi","purl":"pkg:pypi/uwsgi@2.0.15","type":"python","version":"2.0.15","language":"python","licenses":["GPL2"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h2vm-c85r-5vh5","versionConstraint":"<2.0.17 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"uwsgi","version":"2.0.15"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-h2vm-c85r-5vh5","fix":{"state":"fixed","versions":["2.0.17"],"available":[{"date":"2024-04-29","kind":"first-observed","version":"2.0.17"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7490","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7490","date":"2026-10-08","epss":0.69423,"percentile":0.99346}],"risk":54.14994000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-7490","https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html","https://www.debian.org/security/2018/dsa-4142","https://github.com/unbit/uwsgi/commit/0a480f435ea6feb63deb410ad2bf376ed3f05f8a","https://www.exploit-db.com/exploits/44223","https://github.com/pypa/advisory-database/tree/main/vulns/uwsgi/PYSEC-2018-78.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h2vm-c85r-5vh5","description":"uWSGI Directory Traversal vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2018-7490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7490","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7490","date":"2026-10-08","epss":0.69423,"percentile":0.99346}],"urls":["https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html","https://www.debian.org/security/2018/dsa-4142","https://www.exploit-db.com/exploits/44223/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7490","description":"uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.11.27"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfq6-hq5r-27r6","versionConstraint":"<1.11.27 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vfq6-hq5r-27r6","fix":{"state":"fixed","versions":["1.11.27"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.11.27"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19844","cwe":"CWE-640","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19844","date":"2026-10-08","epss":0.53561,"percentile":0.98969}],"risk":49.67782750000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-19844","https://github.com/django/django/commit/5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb70","https://github.com/django/django/commit/f4cff43bf921fcea6a29b726eb66767f67753fa2","https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a0","https://seclists.org/bugtraq/2020/Jan/9","https://www.debian.org/security/2020/dsa-4598","http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html","https://security.gentoo.org/glsa/202004-17","https://github.com/django/django/commit/302a4ff1e8b1c798aab97673909c7a3dfda42c26","https://github.com/django/django/commit/4d334bea06cac63dc1272abcec545b85136cca0e","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-16.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD","https://security.netapp.com/advisory/ntap-20200110-0003","https://usn.ubuntu.com/4224-1","https://www.djangoproject.com/weblog/2019/dec/18/security-releases"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfq6-hq5r-27r6","description":"Django Potential account hijack via password reset form"},"relatedVulnerabilities":[{"id":"CVE-2019-19844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19844","cwe":"CWE-640","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19844","date":"2026-10-08","epss":0.53561,"percentile":0.98969}],"urls":["http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html","https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/","https://seclists.org/bugtraq/2020/Jan/9","https://security.gentoo.org/glsa/202004-17","https://security.netapp.com/advisory/ntap-20200110-0003/","https://usn.ubuntu.com/4224-1/","https://www.debian.org/security/2020/dsa-4598","https://www.djangoproject.com/weblog/2019/dec/18/security-releases/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19844","description":"Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)"}]},{"artifact":{"id":"eb3307d2038e01a5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.0.3","type":"python","version":"2.0.3","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"39.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4qr-2fvf-3mr5","versionConstraint":">=0.8.1,<39.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.0.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-x4qr-2fvf-3mr5","fix":{"state":"fixed","versions":["39.0.1"],"available":[{"date":"2023-02-09","kind":"first-observed","version":"39.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5","https://nvd.nist.gov/vuln/detail/CVE-2023-0286","https://rustsec.org/advisories/RUSTSEC-2023-0006.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://access.redhat.com/security/cve/cve-2023-0286","https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4qr-2fvf-3mr5","description":"Vulnerable OpenSSL included in cryptography wheels"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"2ca46dc98110edb6","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u7","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"risk":34.0695,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14867","versionConstraint":"< 1:2.1.4-2.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14867","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-08","epss":0.36003,"percentile":0.98439}],"risk":27.00225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3984-1","link":"https://security-tracker.debian.org/tracker/DSA-3984-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14867"},"relatedVulnerabilities":[{"id":"CVE-2017-14867","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-08","epss":0.36003,"percentile":0.98439}],"urls":["http://www.openwall.com/lists/oss-security/2017/09/26/9","http://www.securityfocus.com/bid/101060","http://www.securitytracker.com/id/1039431","https://bugs.debian.org/876854","https://lists.debian.org/debian-security-announce/2017/msg00246.html","https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","https://www.debian.org/security/2017/dsa-3984"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14867","description":"Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14867","versionConstraint":"< 1:2.1.4-2.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14867","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-08","epss":0.36003,"percentile":0.98439}],"risk":27.00225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3984-1","link":"https://security-tracker.debian.org/tracker/DSA-3984-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14867"},"relatedVulnerabilities":[{"id":"CVE-2017-14867","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-08","epss":0.36003,"percentile":0.98439}],"urls":["http://www.openwall.com/lists/oss-security/2017/09/26/9","http://www.securityfocus.com/bid/101060","http://www.securitytracker.com/id/1039431","https://bugs.debian.org/876854","https://lists.debian.org/debian-security-announce/2017/msg00246.html","https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","https://www.debian.org/security/2017/dsa-3984"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14867","description":"Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-08","epss":0.34007,"percentile":0.98363}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"< 7.38.0-4+deb8u15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"fixed","versions":["7.38.0-4+deb8u15"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u15"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-08","epss":0.49739,"percentile":0.9887}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-08","epss":0.49739,"percentile":0.9887}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"risk":24.4155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"risk":24.4155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"risk":24.4155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-08","epss":0.48831,"percentile":0.98849}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-08","epss":0.48062,"percentile":0.98829}],"risk":24.031,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4212-1","link":"https://security-tracker.debian.org/tracker/DSA-4212-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-08","epss":0.48062,"percentile":0.98829}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-08","epss":0.48062,"percentile":0.98829}],"risk":24.031,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4212-1","link":"https://security-tracker.debian.org/tracker/DSA-4212-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-08","epss":0.48062,"percentile":0.98829}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.6.13||>= 3.10.0a0, < 3.10.0||>= 3.7.0a0, < 3.7.10||>= 3.8.0a0, < 3.8.8||>= 3.9.0a0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.6.13||>= 3.10.0a0, < 3.10.0||>= 3.7.0a0, < 3.7.10||>= 3.8.0a0, < 3.8.8||>= 3.9.0a0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.8","3.9.2","3.10.0"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.6.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.0"},{"date":"2026-09-22","kind":"first-observed","version":"3.7.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.8.8"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.2"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.0"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.002521666666667,"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-23336","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.8||>= 3.9.0, < 3.9.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.8","3.9.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":20.911146666666667,"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-4559","versionConstraint":"< 3.6.16||>= 3.10.0, < 3.10.12||>= 3.11.0, < 3.11.4||>= 3.7.0, < 3.8.17||>= 3.9.0, < 3.9.17 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"fixed","versions":["3.6.16","3.8.17","3.9.17","3.10.12","3.11.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.12"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.17"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-08","epss":0.27095,"percentile":0.98006}],"risk":18.018175000000003,"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."},"relatedVulnerabilities":[]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-08","epss":0.24014,"percentile":0.97791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-1000802","versionConstraint":">= 2.7.0, < 2.7.16 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["2.7.16"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.16"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-08","epss":0.20126,"percentile":0.97399}],"risk":17.761195,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-frmv-pr5f-9mcr","versionConstraint":"<4.2.26 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-frmv-pr5f-9mcr","fix":{"state":"fixed","versions":["4.2.26"],"available":[{"date":"2025-11-06","kind":"first-observed","version":"4.2.26"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64459","cwe":"CWE-89","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64459","date":"2026-10-08","epss":0.19257,"percentile":0.97275}],"risk":17.427585,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64459","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases","https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85","https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4","https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b","https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241","https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html","https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-frmv-pr5f-9mcr","description":"Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects."},"relatedVulnerabilities":[{"id":"CVE-2025-64459","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64459","cwe":"CWE-89","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64459","date":"2026-10-08","epss":0.19257,"percentile":0.97275}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases/","https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64459","description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-24329","versionConstraint":"< 3.7.17||>= 3.10.0, < 3.10.12||>= 3.11.0, < 3.11.4||>= 3.8.0, < 3.8.17||>= 3.9.0, < 3.9.17 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"fixed","versions":["3.7.17","3.8.17","3.9.17","3.10.12","3.11.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.12"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.17"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-5010","versionConstraint":">= 2.7.0, < 2.7.16||>= 3.4.0, < 3.4.10||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"fixed","versions":["2.7.16","3.4.10","3.5.7","3.6.9","3.7.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-08","epss":0.20743,"percentile":0.97484}],"risk":14.139811666666665,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.38.0-4+deb8u16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.38.0-4+deb8u16"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u16"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"risk":13.454250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6w2r-r2m5-xq5w","versionConstraint":"<4.2.24 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-6w2r-r2m5-xq5w","fix":{"state":"fixed","versions":["4.2.24"],"available":[{"date":"2025-09-10","kind":"first-observed","version":"4.2.24"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57833","cwe":"CWE-89","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-57833","date":"2026-10-08","epss":0.16759,"percentile":0.96968}],"risk":12.23407,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-57833","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898","https://www.djangoproject.com/weblog/2025/sep/03/security-releases","https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5","https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92","https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243","https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html","http://www.openwall.com/lists/oss-security/2025/09/03/3","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6w2r-r2m5-xq5w","description":"Django is subject to SQL injection through its column aliases"},"relatedVulnerabilities":[{"id":"CVE-2025-57833","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57833","cwe":"CWE-89","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-57833","date":"2026-10-08","epss":0.16759,"percentile":0.96968}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898","https://www.djangoproject.com/weblog/2025/sep/03/security-releases/","http://www.openwall.com/lists/oss-security/2025/09/03/3","https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57833","description":"An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias()."}]},{"artifact":{"id":"e9bcfc704cee792c","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"8f4ff33619882fd1","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"a1c91ab754578fc9","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"d12534a6470be934","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"dd7de04c6f6544ab","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-08","epss":0.39969,"percentile":0.98596}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-0718","versionConstraint":">= 2.7.0, < 2.7.15||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.4||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-0718","fix":{"state":"fixed","versions":["2.7.15","3.3.7","3.4.7","3.5.4","3.6.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.3.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0718","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0718","date":"2026-10-08","epss":0.13335,"percentile":0.96316}],"risk":11.7681375,"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2016-2824.html","http://seclists.org/fulldisclosure/2017/Feb/68","http://support.eset.com/ca6333/","http://www.debian.org/security/2016/dsa-3582","http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","http://www.openwall.com/lists/oss-security/2016/05/17/12","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/90729","http://www.securitytracker.com/id/1036348","http://www.securitytracker.com/id/1036415","http://www.securitytracker.com/id/1037705","http://www.ubuntu.com/usn/USN-2983-1","http://www.ubuntu.com/usn/USN-3044-1","https://access.redhat.com/errata/RHSA-2018:2486","https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","https://bugzilla.redhat.com/show_bug.cgi?id=1296102","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://security.gentoo.org/glsa/201701-21","https://source.android.com/security/bulletin/2016-11-01.html","https://support.apple.com/HT206903","https://www.tenable.com/security/tns-2016-20"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0718","description":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow."},"relatedVulnerabilities":[]},{"artifact":{"id":"3b4a36ce3d9b9758","cpes":["cpe:2.3:a:apt:apt:1.0.9.8.4:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@1.0.9.8.4?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.9.8.4","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.9.8.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"apt","version":"1.0.9.8.4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.9.8.5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-08","epss":0.14555,"percentile":0.96568}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-08","epss":0.14555,"percentile":0.96568}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"59fabe7ada3b06e2","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.9.8.4:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/debian/libapt-pkg4.12@1.0.9.8.4?arch=amd64&distro=debian-8.9&upstream=apt","type":"deb","version":"1.0.9.8.4","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.9.8.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"apt","version":"1.0.9.8.4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.9.8.5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-08","epss":0.14555,"percentile":0.96568}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-08","epss":0.14555,"percentile":0.96568}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1t-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"risk":10.484,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4018-1","link":"https://security-tracker.debian.org/tracker/DSA-4018-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1t-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"risk":10.484,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4018-1","link":"https://security-tracker.debian.org/tracker/DSA-4018-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1t-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"risk":10.484,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4018-1","link":"https://security-tracker.debian.org/tracker/DSA-4018-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-08","epss":0.20968,"percentile":0.97512}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9948","versionConstraint":">= 2.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.185840000000002,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-08","epss":0.13368,"percentile":0.96327}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3822","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3822","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-08","epss":0.12873,"percentile":0.96213}],"risk":9.65475,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3822"},"relatedVulnerabilities":[{"id":"CVE-2019-3822","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-08","epss":0.12873,"percentile":0.96213}],"urls":["http://www.securityfocus.com/bid/106950","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2019-3822.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.gentoo.org/glsa/201903-03","https://security.netapp.com/advisory/ntap-20190315-0001/","https://security.netapp.com/advisory/ntap-20190719-0004/","https://support.f5.com/csp/article/K84141449","https://support.f5.com/csp/article/K84141449?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1t-1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4157-1","link":"https://security-tracker.debian.org/tracker/DSA-4157-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1t-1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4157-1","link":"https://security-tracker.debian.org/tracker/DSA-4157-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1t-1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4157-1","link":"https://security-tracker.debian.org/tracker/DSA-4157-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-08","epss":0.18596,"percentile":0.97193}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-4472","versionConstraint":">= 2.7.0, < 2.7.15||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.4||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-4472","fix":{"state":"fixed","versions":["2.7.15","3.3.7","3.4.7","3.5.4","3.6.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.3.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4472","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4472","date":"2026-10-08","epss":0.11946,"percentile":0.96023}],"risk":8.929635,"urls":["http://www.securityfocus.com/bid/91528","http://www.ubuntu.com/usn/USN-3013-1","https://bugzilla.redhat.com/show_bug.cgi?id=1344251","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://security.gentoo.org/glsa/201701-21","https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde","https://www.tenable.com/security/tns-2016-20"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4472","description":"The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-08","epss":0.11737,"percentile":0.95976}],"risk":8.802750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-08","epss":0.11737,"percentile":0.95976}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-08","epss":0.11676,"percentile":0.95963}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-08","epss":0.11608,"percentile":0.95946}],"risk":8.706,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-08","epss":0.11608,"percentile":0.95946}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"< 1.0.1t-1+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"< 1.0.1t-1+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"< 1.0.1t-1+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-08","epss":0.17139,"percentile":0.9702}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-08","epss":0.11175,"percentile":0.95853}],"risk":8.38125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-08","epss":0.11175,"percentile":0.95853}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.38.0-4+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-08","epss":0.11115,"percentile":0.95837}],"risk":8.33625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-08","epss":0.11115,"percentile":0.95837}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-08","epss":0.10668,"percentile":0.95702}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"ea49451aea0813f9","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.9&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-08","epss":0.15562,"percentile":0.96753}],"risk":7.781000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-08","epss":0.15562,"percentile":0.96753}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-14647","versionConstraint":">= 2.7.0, <= 2.7.15||>= 3.4.0, <= 3.4.9||>= 3.5.0, <= 3.5.6||>= 3.6.0, <= 3.6.6||= 3.7.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-08","epss":0.10911,"percentile":0.95776}],"risk":7.328554999999999,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 2.7.15||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["2.7.15","3.4.8","3.5.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-08","epss":0.07944,"percentile":0.94599}],"risk":7.010579999999999,"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"},"relatedVulnerabilities":[]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3855","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3855","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3855","date":"2026-10-08","epss":0.09294,"percentile":0.95254}],"risk":6.970499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3855"},"relatedVulnerabilities":[{"id":"CVE-2019-3855","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3855","date":"2026-10-08","epss":0.09294,"percentile":0.95254}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://seclists.org/fulldisclosure/2019/Sep/42","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://seclists.org/bugtraq/2019/Sep/49","https://security.netapp.com/advisory/ntap-20190327-0005/","https://support.apple.com/kb/HT210609","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3855.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3855","description":"An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"e6018bed8eee8681","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1058","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"risk":6.549,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1058"},"relatedVulnerabilities":[{"id":"CVE-2018-1058","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"urls":["http://www.securityfocus.com/bid/103221","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=1547044","https://usn.ubuntu.com/3589-1/","https://www.postgresql.org/about/news/1834/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","description":"A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."}]},{"artifact":{"id":"129495beb6b7ad25","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1058","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"risk":6.549,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1058"},"relatedVulnerabilities":[{"id":"CVE-2018-1058","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1058","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1058","date":"2026-10-08","epss":0.13098,"percentile":0.96266}],"urls":["http://www.securityfocus.com/bid/103221","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=1547044","https://usn.ubuntu.com/3589-1/","https://www.postgresql.org/about/news/1834/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1058","description":"A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10989","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10989","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10989","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10989","date":"2026-10-08","epss":0.08609,"percentile":0.94969}],"risk":6.4567499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10989"},"relatedVulnerabilities":[{"id":"CVE-2017-10989","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10989","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10989","date":"2026-10-08","epss":0.08609,"percentile":0.94969}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html","http://marc.info/?l=sqlite-users&m=149933696214713&w=2","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/99502","http://www.securitytracker.com/id/1039427","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405","https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://sqlite.org/src/info/66de6f4a","https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10989","description":"The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8816","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8816","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-08","epss":0.08523,"percentile":0.94921}],"risk":6.392249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8816"},"relatedVulnerabilities":[{"id":"CVE-2017-8816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-08","epss":0.08523,"percentile":0.94921}],"urls":["http://security.cucumberlinux.com/security/details.php?id=161","http://www.securityfocus.com/bid/101998","http://www.securitytracker.com/id/1039896","http://www.securitytracker.com/id/1040608","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-12e7.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","description":"The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-08","epss":0.12154,"percentile":0.96062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9636","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.0.0, < 3.4.10||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"fixed","versions":["2.7.17","3.4.10","3.5.7","3.6.9","3.7.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-08","epss":0.07673,"percentile":0.94445}],"risk":6.023305000000001,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-9233","versionConstraint":">= 2.7.0, < 2.7.15||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.4||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-9233","fix":{"state":"fixed","versions":["2.7.15","3.3.7","3.4.7","3.5.4","3.6.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.3.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-10-08","epss":0.08739,"percentile":0.95033}],"risk":6.008062499999999,"urls":["http://www.debian.org/security/2017/dsa-3898","http://www.openwall.com/lists/oss-security/2017/06/17/7","http://www.securityfocus.com/bid/99276","http://www.securitytracker.com/id/1039427","https://github.com/libexpat/libexpat/blob/master/expat/Changes","https://libexpat.github.io/doc/cve-2017-9233/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://support.f5.com/csp/article/K03244804"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9233","description":"XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea49451aea0813f9","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.9&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-08","epss":0.07977,"percentile":0.94615}],"risk":5.982749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-08","epss":0.07977,"percentile":0.94615}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.14"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-0391","versionConstraint":"< 3.6.14||>= 3.7.0, < 3.7.11||>= 3.8.0, < 3.8.11||>= 3.9.0, < 3.9.5||= 3.10.0-alpha1||= 3.10.0-alpha2||= 3.10.0-alpha3||= 3.10.0-alpha4||= 3.10.0-alpha5||= 3.10.0-alpha6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"fixed","versions":["3.6.14","3.7.11","3.8.11","3.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.14"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":5.8968750000000005,"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13115","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13115","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"risk":5.8295,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13115"},"relatedVulnerabilities":[{"id":"CVE-2019-13115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"urls":["http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow/","https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa","https://github.com/libssh2/libssh2/pull/350","https://libssh2.org/changes.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://security.netapp.com/advisory/ntap-20190806-0002/","https://support.f5.com/csp/article/K13322484","https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"risk":5.7985,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"risk":5.7985,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"risk":5.7985,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-08","epss":0.11597,"percentile":0.95945}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h582-2pch-3xv3","versionConstraint":">=1.5,<1.7.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-h582-2pch-3xv3","fix":{"state":"fixed","versions":["1.7.9"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.7.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5143","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5143","date":"2026-10-08","epss":0.07266,"percentile":0.94199}],"risk":5.66748,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5143","https://security.gentoo.org/glsa/201510-06","http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://rhn.redhat.com/errata/RHSA-2015-1678.html","http://rhn.redhat.com/errata/RHSA-2015-1686.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.ubuntu.com/usn/USN-2671-1","https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663","https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9","https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16","https://www.djangoproject.com/weblog/2015/jul/08/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-20.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h582-2pch-3xv3","description":"Django Denial-of-service by filling session store"},"relatedVulnerabilities":[{"id":"CVE-2015-5143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5143","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5143","date":"2026-10-08","epss":0.07266,"percentile":0.94199}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://rhn.redhat.com/errata/RHSA-2015-1678.html","http://rhn.redhat.com/errata/RHSA-2015-1686.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.securityfocus.com/bid/75666","http://www.securitytracker.com/id/1032820","http://www.ubuntu.com/usn/USN-2671-1","https://security.gentoo.org/glsa/201510-06","https://www.djangoproject.com/weblog/2015/jul/08/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5143","description":"The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9841","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"risk":5.6625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9841"},"relatedVulnerabilities":[{"id":"CVE-2016-9841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9841","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"risk":5.6625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9841"},"relatedVulnerabilities":[{"id":"CVE-2016-9841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-08","epss":0.0755,"percentile":0.94367}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"201c7c9f2573b717","cpes":["cpe:2.3:a:python:requests:2.12.5:*:*:*:*:*:*:*"],"name":"requests","purl":"pkg:pypi/requests@2.12.5","type":"python","version":"2.12.5","language":"python","licenses":["Apache 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.20.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x84v-xcm2-53pg","versionConstraint":"<=2.19.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"requests","version":"2.12.5"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-x84v-xcm2-53pg","fix":{"state":"fixed","versions":["2.20.0"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"2.20.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18074","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18074","date":"2026-10-08","epss":0.07443,"percentile":0.94307}],"risk":5.58225,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-18074","https://github.com/requests/requests/issues/4716","https://github.com/requests/requests/pull/4718","https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff","https://access.redhat.com/errata/RHSA-2019:2035","https://bugs.debian.org/910766","http://docs.python-requests.org/en/master/community/updates/#release-and-version-history","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml","https://usn.ubuntu.com/3790-1","https://usn.ubuntu.com/3790-2"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x84v-xcm2-53pg","description":"Insufficiently Protected Credentials in Requests"},"relatedVulnerabilities":[{"id":"CVE-2018-18074","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18074","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18074","date":"2026-10-08","epss":0.07443,"percentile":0.94307}],"urls":["http://docs.python-requests.org/en/master/community/updates/#release-and-version-history","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html","https://access.redhat.com/errata/RHSA-2019:2035","https://bugs.debian.org/910766","https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff","https://github.com/requests/requests/issues/4716","https://github.com/requests/requests/pull/4718","https://usn.ubuntu.com/3790-1/","https://usn.ubuntu.com/3790-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18074","description":"The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network."}]},{"artifact":{"id":"2a64fc520facee24","cpes":["cpe:2.3:a:kirill_simonov_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:pyyaml:3.11:*:*:*:*:*:*:*"],"name":"pyyaml","purl":"pkg:pypi/pyyaml@3.11","type":"python","version":"3.11","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8q59-q68h-6hv4","versionConstraint":"<5.4 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyyaml","version":"3.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8q59-q68h-6hv4","fix":{"state":"fixed","versions":["5.4"],"available":[{"date":"2021-03-26","kind":"first-observed","version":"5.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14343","date":"2026-10-08","epss":0.05984,"percentile":0.93124}],"risk":5.55016,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-14343","https://github.com/yaml/pyyaml/commit/a001f2782501ad2d24986959f0239a354675f9dc","https://bugzilla.redhat.com/show_bug.cgi?id=1860466","https://github.com/yaml/pyyaml/issues/420#issuecomment-663673966","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/SeldonIO/seldon-core/issues/2252","https://github.com/yaml/pyyaml/issues/420","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2021-142.yaml","https://pypi.org/project/PyYAML"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8q59-q68h-6hv4","description":"Improper Input Validation in PyYAML"},"relatedVulnerabilities":[{"id":"CVE-2020-14343","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-14343","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14343","date":"2026-10-08","epss":0.05984,"percentile":0.93124}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1860466","https://github.com/SeldonIO/seldon-core/issues/2252","https://github.com/yaml/pyyaml/issues/420","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14343","description":"A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747."}]},{"artifact":{"id":"d3136b98e7a1e577","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u4:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=expat","type":"deb","version":"2.1.0-6+deb8u4","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20843","versionConstraint":"< 2.1.0-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"expat","version":"2.1.0-6+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20843","fix":{"state":"fixed","versions":["2.1.0-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20843","date":"2026-10-08","epss":0.07107,"percentile":0.94086}],"risk":5.3302499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20843"},"relatedVulnerabilities":[{"id":"CVE-2018-20843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20843","date":"2026-10-08","epss":0.07107,"percentile":0.94086}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226","https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes","https://github.com/libexpat/libexpat/issues/186","https://github.com/libexpat/libexpat/pull/262","https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6","https://lists.debian.org/debian-lts-announce/2019/06/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/","https://seclists.org/bugtraq/2019/Jun/39","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190703-0001/","https://support.f5.com/csp/article/K51011533","https://usn.ubuntu.com/4040-1/","https://usn.ubuntu.com/4040-2/","https://www.debian.org/security/2019/dsa-4472","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","description":"In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks)."}]},{"artifact":{"id":"2a64fc520facee24","cpes":["cpe:2.3:a:kirill_simonov_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonovproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:kirill_simonov:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python-pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python_pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi_project:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python-pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:python_pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xiproject:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:python:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:pyyaml:pyyaml:3.11:*:*:*:*:*:*:*","cpe:2.3:a:xi:pyyaml:3.11:*:*:*:*:*:*:*"],"name":"pyyaml","purl":"pkg:pypi/pyyaml@3.11","type":"python","version":"3.11","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/PyYAML-3.11-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rprw-h62v-c2w7","versionConstraint":"<5.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyyaml","version":"3.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-rprw-h62v-c2w7","fix":{"state":"fixed","versions":["5.1"],"available":[{"date":"2026-07-02","kind":"first-observed","version":"5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18342","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18342","date":"2026-10-08","epss":0.05656,"percentile":0.92774}],"risk":5.3166400000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-18342","https://github.com/marshmallow-code/apispec/issues/278","https://github.com/yaml/pyyaml/issues/193","https://github.com/yaml/pyyaml/pull/74","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation","https://security.gentoo.org/glsa/202003-45","https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA","https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rprw-h62v-c2w7","description":"PyYAML insecurely deserializes YAML strings leading to arbitrary code execution"},"relatedVulnerabilities":[{"id":"CVE-2017-18342","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18342","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18342","date":"2026-10-08","epss":0.05656,"percentile":0.92774}],"urls":["https://github.com/marshmallow-code/apispec/issues/278","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://github.com/yaml/pyyaml/issues/193","https://github.com/yaml/pyyaml/pull/74","https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/","https://security.gentoo.org/glsa/202003-45"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18342","description":"In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"risk":5.279249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4448"},"relatedVulnerabilities":[{"id":"CVE-2016-4448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.openwall.com/lists/oss-security/2016/05/25/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/90856","http://www.securitytracker.com/id/1036348","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722","http://xmlsoft.org/news.html","https://access.redhat.com/errata/RHSA-2016:1292","https://bugzilla.redhat.com/show_bug.cgi?id=1338700","https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9","https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709","https://kc.mcafee.com/corporate/index?page=content&id=SB10170","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905","https://www.tenable.com/security/tns-2016-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4448","description":"Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"risk":5.279249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4448"},"relatedVulnerabilities":[{"id":"CVE-2016-4448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-08","epss":0.07039,"percentile":0.9403}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.openwall.com/lists/oss-security/2016/05/25/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/90856","http://www.securitytracker.com/id/1036348","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722","http://xmlsoft.org/news.html","https://access.redhat.com/errata/RHSA-2016:1292","https://bugzilla.redhat.com/show_bug.cgi?id=1338700","https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9","https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709","https://kc.mcafee.com/corporate/index?page=content&id=SB10170","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905","https://www.tenable.com/security/tns-2016-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4448","description":"Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20346","versionConstraint":"< 3.8.7.1-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20346","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-08","epss":0.10312,"percentile":0.95595}],"risk":5.156000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20346"},"relatedVulnerabilities":[{"id":"CVE-2018-20346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-08","epss":0.10312,"percentile":0.95595}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://www.securityfocus.com/bid/106323","https://access.redhat.com/articles/3758321","https://blade.tencent.com/magellan/index_en.html","https://bugzilla.redhat.com/show_bug.cgi?id=1659379","https://bugzilla.redhat.com/show_bug.cgi?id=1659677","https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html","https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e","https://crbug.com/900910","https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://news.ycombinator.com/item?id=18685296","https://security.gentoo.org/glsa/201904-21","https://sqlite.org/src/info/940f2adc8541a838","https://sqlite.org/src/info/d44318f59044162e","https://support.apple.com/HT209443","https://support.apple.com/HT209446","https://support.apple.com/HT209447","https://support.apple.com/HT209448","https://support.apple.com/HT209450","https://support.apple.com/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://worthdoingbadly.com/sqlitebug/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/releaselog/3_25_3.html","https://www.synology.com/security/advisory/Synology_SA_18_61"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20346","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"risk":5.0235,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"risk":5.0235,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-08","epss":0.10047,"percentile":0.95514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-08","epss":0.06477,"percentile":0.93576}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-9063","versionConstraint":">= 2.7.0, < 2.7.15||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.4||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-9063","fix":{"state":"fixed","versions":["2.7.15","3.3.7","3.4.7","3.5.4","3.6.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.3.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9063","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9063","date":"2026-10-08","epss":0.05472,"percentile":0.92551}],"risk":4.82904,"urls":["http://www.securityfocus.com/bid/94337","http://www.securitytracker.com/id/1037298","http://www.securitytracker.com/id/1039427","https://bugzilla.mozilla.org/show_bug.cgi?id=1274777","https://www.debian.org/security/2017/dsa-3898","https://www.mozilla.org/security/advisories/mfsa2016-89/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9063","description":"An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.13"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.6.13||>= 3.7.0, < 3.7.10||>= 3.8.0, < 3.8.7||>= 3.9.0, < 3.9.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.6.13","3.7.10","3.8.7","3.9.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-08","epss":0.09205,"percentile":0.95221}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-08","epss":0.09205,"percentile":0.95221}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-15903","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.10||>= 3.7.0, < 3.7.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.10","3.7.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"risk":4.594741666666667,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."},"relatedVulnerabilities":[]},{"artifact":{"id":"e6018bed8eee8681","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9193","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9193","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"risk":4.58275,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9193"},"relatedVulnerabilities":[{"id":"CVE-2019-9193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"urls":["http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html","http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html","http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html","https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/","https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5","https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/","https://security.netapp.com/advisory/ntap-20190502-0003/","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9193","description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’."}]},{"artifact":{"id":"129495beb6b7ad25","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9193","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9193","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"risk":4.58275,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9193"},"relatedVulnerabilities":[{"id":"CVE-2019-9193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9193","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9193","date":"2026-10-08","epss":0.91655,"percentile":0.99814}],"urls":["http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html","http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html","http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html","https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/","https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5","https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/","https://security.netapp.com/advisory/ntap-20190502-0003/","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9193","description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-08","epss":0.09039,"percentile":0.95166}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-08","epss":0.09039,"percentile":0.95166}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-10160","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4||= 3.8.0-alpha4||= 3.8.0-beta1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.495220000000001,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"c785efba1000c46e","cpes":["cpe:2.3:a:libprocps3:libprocps3:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"libprocps3","purl":"pkg:deb/debian/libprocps3@2%3A3.3.9-9?arch=amd64&distro=debian-8.9&upstream=procps","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprocps3/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libprocps3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"procps"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-08","epss":0.08902,"percentile":0.95112}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-08","epss":0.08902,"percentile":0.95112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"de8e877fa8628b52","cpes":["cpe:2.3:a:procps:procps:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"procps","purl":"pkg:deb/debian/procps@2%3A3.3.9-9?arch=amd64&distro=debian-8.9","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/procps/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/procps/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.list"},{"path":"/var/lib/dpkg/info/procps.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.postinst"},{"path":"/var/lib/dpkg/info/procps.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.postrm"},{"path":"/var/lib/dpkg/info/procps.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.preinst"},{"path":"/var/lib/dpkg/info/procps.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-08","epss":0.08902,"percentile":0.95112}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-08","epss":0.08902,"percentile":0.95112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crhm-qpjc-cm64","versionConstraint":"<1.8.15 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-crhm-qpjc-cm64","fix":{"state":"fixed","versions":["1.8.15"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7401","cwe":"CWE-254","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7401","date":"2026-10-08","epss":0.05702,"percentile":0.92815}],"risk":4.44756,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-7401","http://rhn.redhat.com/errata/RHSA-2016-2038.html","http://rhn.redhat.com/errata/RHSA-2016-2039.html","http://rhn.redhat.com/errata/RHSA-2016-2040.html","http://rhn.redhat.com/errata/RHSA-2016-2041.html","http://rhn.redhat.com/errata/RHSA-2016-2042.html","http://rhn.redhat.com/errata/RHSA-2016-2043.html","http://www.debian.org/security/2016/dsa-3678","http://www.ubuntu.com/usn/USN-3089-1","https://web.archive.org/web/20200227223637/http://www.securityfocus.com/bid/93182","https://web.archive.org/web/20210927195154/http://www.securitytracker.com/id/1036899","https://github.com/django/django/commit/6fe846a8f08dc959003f298b5407e321c6fe3735","https://github.com/django/django/commit/6118ab7d0676f0d622278e5be215f14fb5410b6a","https://github.com/django/django/commit/d1bc980db1c0fffd6d60677e62f70beadb9fe64a","https://www.djangoproject.com/weblog/2016/sep/26/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-3.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crhm-qpjc-cm64","description":"Django CSRF Protection Bypass"},"relatedVulnerabilities":[{"id":"CVE-2016-7401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7401","cwe":"CWE-254","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7401","date":"2026-10-08","epss":0.05702,"percentile":0.92815}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2038.html","http://rhn.redhat.com/errata/RHSA-2016-2039.html","http://rhn.redhat.com/errata/RHSA-2016-2040.html","http://rhn.redhat.com/errata/RHSA-2016-2041.html","http://rhn.redhat.com/errata/RHSA-2016-2042.html","http://rhn.redhat.com/errata/RHSA-2016-2043.html","http://www.debian.org/security/2016/dsa-3678","http://www.securityfocus.com/bid/93182","http://www.securitytracker.com/id/1036899","http://www.ubuntu.com/usn/USN-3089-1","https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7401","description":"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-08","epss":0.05782,"percentile":0.92905}],"risk":4.3365,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-08","epss":0.05782,"percentile":0.92905}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9843","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"risk":4.3245000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9843"},"relatedVulnerabilities":[{"id":"CVE-2016-9843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9843","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"risk":4.3245000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9843"},"relatedVulnerabilities":[{"id":"CVE-2016-9843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-08","epss":0.05766,"percentile":0.92891}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."}]},{"artifact":{"id":"4f17062a9c4e448e","cpes":["cpe:2.3:a:gnupg:gnupg:1.4.18-7\\+deb8u4:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/debian/gnupg@1.4.18-7%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1.4.18-7+deb8u4","language":"","licenses":["GPL-3","GPL-3+","RFC-Reference"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gnupg.list"},{"path":"/var/lib/dpkg/info/gnupg.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gnupg.postinst"},{"path":"/var/lib/dpkg/info/gnupg.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gnupg.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.18-7+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.18-7+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gnupg","version":"1.4.18-7+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.18-7+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.18-7+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-08","epss":0.08546,"percentile":0.94935}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4224-1","link":"https://security-tracker.debian.org/tracker/DSA-4224-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-08","epss":0.08546,"percentile":0.94935}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"0d4c065bfc59528f","cpes":["cpe:2.3:a:gpgv:gpgv:1.4.18-7\\+deb8u4:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/debian/gpgv@1.4.18-7%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=gnupg","type":"deb","version":"1.4.18-7+deb8u4","language":"","licenses":["GPL-3","GPL-3+","RFC-Reference"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.18-7+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.18-7+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gnupg","version":"1.4.18-7+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.18-7+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.18-7+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-08","epss":0.08546,"percentile":0.94935}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4224-1","link":"https://security-tracker.debian.org/tracker/DSA-4224-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-08","epss":0.08546,"percentile":0.94935}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-08","epss":0.08465,"percentile":0.94889}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-08","epss":0.08465,"percentile":0.94889}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"12b1ddfd0a9b8177","cpes":["cpe:2.3:a:python:urllib3:1.16:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.16","type":"python","version":"1.16","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-www2-v7xj-xrc6","versionConstraint":"<1.23 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.16"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-www2-v7xj-xrc6","fix":{"state":"fixed","versions":["1.23"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.23"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20060","date":"2026-10-08","epss":0.04488,"percentile":0.91237}],"risk":4.16262,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-20060","https://github.com/urllib3/urllib3/issues/1316","https://github.com/urllib3/urllib3/pull/1346","https://access.redhat.com/errata/RHSA-2019:2272","https://bugzilla.redhat.com/show_bug.cgi?id=1649153","https://github.com/urllib3/urllib3/blob/master/CHANGES.rst","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ","https://usn.ubuntu.com/3990-1","https://security.netapp.com/advisory/ntap-20241227-0010","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-www2-v7xj-xrc6","description":"Exposure of Sensitive Information to an Unauthorized Actor in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2018-20060","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20060","date":"2026-10-08","epss":0.04488,"percentile":0.91237}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","https://access.redhat.com/errata/RHSA-2019:2272","https://bugzilla.redhat.com/show_bug.cgi?id=1649153","https://github.com/urllib3/urllib3/blob/master/CHANGES.rst","https://github.com/urllib3/urllib3/issues/1316","https://github.com/urllib3/urllib3/pull/1346","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/","https://usn.ubuntu.com/3990-1/","https://security.netapp.com/advisory/ntap-20241227-0010/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20060","description":"urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-08","epss":0.05506,"percentile":0.92588}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7141","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7141","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-08","epss":0.0818,"percentile":0.94734}],"risk":4.09,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7141"},"relatedVulnerabilities":[{"id":"CVE-2016-7141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-08","epss":0.0818,"percentile":0.94734}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92754","http://www.securitytracker.com/id/1036739","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=1373229","https://curl.haxx.se/docs/adv_20160907.html","https://github.com/curl/curl/commit/curl-7_50_2~32","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201701-47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","description":"curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420."}]},{"artifact":{"id":"0edcd4b35209fc0e","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"c9f7a7dc73893658","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19603","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19603","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-08","epss":0.0803,"percentile":0.94645}],"risk":4.015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19603"},"relatedVulnerabilities":[{"id":"CVE-2019-19603","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-08","epss":0.0803,"percentile":0.94645}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://security.netapp.com/advisory/ntap-20191223-0001/","https://usn.ubuntu.com/4394-1/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19603","description":"SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-8740","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-8740","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-8740","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8740","date":"2026-10-08","epss":0.07966,"percentile":0.94609}],"risk":3.9829999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-8740"},"relatedVulnerabilities":[{"id":"CVE-2018-8740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8740","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8740","date":"2026-10-08","epss":0.07966,"percentile":0.94609}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html","http://www.securityfocus.com/bid/103466","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6964","https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1756349","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://usn.ubuntu.com/4205-1/","https://usn.ubuntu.com/4394-1/","https://www.sqlite.org/cgi/src/timeline?r=corrupt-schema","https://www.sqlite.org/cgi/src/vdiff?from=1774f1c3baf0bc3d&to=d75e67654aa9620b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8740","description":"In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2518","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2518","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-2518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2518","date":"2026-10-08","epss":0.05279,"percentile":0.9236}],"risk":3.9592499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2518"},"relatedVulnerabilities":[{"id":"CVE-2017-2518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2518","date":"2026-10-08","epss":0.05279,"percentile":0.9236}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2518","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3862","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3862","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3862","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3862","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3862","date":"2026-10-08","epss":0.07898,"percentile":0.94578}],"risk":3.949,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3862"},"relatedVulnerabilities":[{"id":"CVE-2019-3862","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3862","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3862","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3862","date":"2026-10-08","epss":0.07898,"percentile":0.94578}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:1884","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3862","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3862.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3862","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11068","versionConstraint":"< 1.1.28-2+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11068","fix":{"state":"fixed","versions":["1.1.28-2+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2019-11068","date":"2026-10-08","epss":0.0523,"percentile":0.92306}],"risk":3.9224999999999994,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11068"},"relatedVulnerabilities":[{"id":"CVE-2019-11068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-11068","date":"2026-10-08","epss":0.0523,"percentile":0.92306}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html","http://www.openwall.com/lists/oss-security/2019/04/22/1","http://www.openwall.com/lists/oss-security/2019/04/23/5","https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6","https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://security.netapp.com/advisory/ntap-20191017-0001/","https://usn.ubuntu.com/3947-1/","https://usn.ubuntu.com/3947-2/","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11068","description":"libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-11068","versionConstraint":"< 1.1.28-2+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-11068","fix":{"state":"fixed","versions":["1.1.28-2+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2019-11068","date":"2026-10-08","epss":0.0523,"percentile":0.92306}],"risk":3.9224999999999994,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-11068"},"relatedVulnerabilities":[{"id":"CVE-2019-11068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-11068","date":"2026-10-08","epss":0.0523,"percentile":0.92306}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html","http://www.openwall.com/lists/oss-security/2019/04/22/1","http://www.openwall.com/lists/oss-security/2019/04/23/5","https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6","https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://security.netapp.com/advisory/ntap-20191017-0001/","https://usn.ubuntu.com/3947-1/","https://usn.ubuntu.com/3947-2/","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11068","description":"libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-7595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-7595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"risk":3.918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-7595"},"relatedVulnerabilities":[{"id":"CVE-2020-7595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","description":"xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-7595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-7595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"risk":3.918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-7595"},"relatedVulnerabilities":[{"id":"CVE-2020-7595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-08","epss":0.07836,"percentile":0.94538}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","description":"xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7rm-8j6h-r933","versionConstraint":"<=6.2.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-r7rm-8j6h-r933","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2022-06-24","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5311","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5311","date":"2026-10-08","epss":0.04212,"percentile":0.90724}],"risk":3.90663,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5311","https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0580","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-82.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7rm-8j6h-r933","description":"Buffer Copy without Checking Size of Input in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5311","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5311","date":"2026-10-08","epss":0.04212,"percentile":0.90724}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0580","https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5311","description":"libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-8492","versionConstraint":">= 2.7.0, <= 2.7.17||>= 3.5.0, <= 3.5.9||>= 3.6.0, <= 3.6.10||>= 3.7.0, <= 3.7.6||>= 3.8.0, <= 3.8.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.870945,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wvg-mj6g-m9cv","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3wvg-mj6g-m9cv","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27922","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27922","date":"2026-10-08","epss":0.04851,"percentile":0.91799}],"risk":3.7837799999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27922","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-41.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv","description":"Pillow Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27922","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27922","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27922","date":"2026-10-08","epss":0.04851,"percentile":0.91799}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27922","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20506","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-08","epss":0.07565,"percentile":0.94378}],"risk":3.7824999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20506"},"relatedVulnerabilities":[{"id":"CVE-2018-20506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-08","epss":0.07565,"percentile":0.94378}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://seclists.org/fulldisclosure/2019/Jan/62","http://seclists.org/fulldisclosure/2019/Jan/64","http://seclists.org/fulldisclosure/2019/Jan/66","http://seclists.org/fulldisclosure/2019/Jan/67","http://seclists.org/fulldisclosure/2019/Jan/68","http://seclists.org/fulldisclosure/2019/Jan/69","http://www.securityfocus.com/bid/106698","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://seclists.org/bugtraq/2019/Jan/28","https://seclists.org/bugtraq/2019/Jan/29","https://seclists.org/bugtraq/2019/Jan/31","https://seclists.org/bugtraq/2019/Jan/32","https://seclists.org/bugtraq/2019/Jan/33","https://seclists.org/bugtraq/2019/Jan/39","https://security.netapp.com/advisory/ntap-20190502-0004/","https://sqlite.org/src/info/940f2adc8541a838","https://support.apple.com/kb/HT209443","https://support.apple.com/kb/HT209446","https://support.apple.com/kb/HT209447","https://support.apple.com/kb/HT209448","https://support.apple.com/kb/HT209450","https://support.apple.com/kb/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20506","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4609","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4609","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"risk":3.75525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4609"},"relatedVulnerabilities":[{"id":"CVE-2016-4609","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4609","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4609","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4609","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"risk":3.75525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4609"},"relatedVulnerabilities":[{"id":"CVE-2016-4609","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4609","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4609","date":"2026-10-08","epss":0.05007,"percentile":0.92023}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4609","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4610","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4610","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"risk":3.72375,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4610"},"relatedVulnerabilities":[{"id":"CVE-2016-4610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4610","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4610","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4610","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"risk":3.72375,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4610"},"relatedVulnerabilities":[{"id":"CVE-2016-4610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4610","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4610","date":"2026-10-08","epss":0.04965,"percentile":0.91969}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://www.securityfocus.com/bid/91826","http://www.securitytracker.com/id/1036348","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4610","description":"libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612."}]},{"artifact":{"id":"e0c6a93aa7e9617e","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"2b62d95a9e611fdf","cpes":["cpe:2.3:a:libudev1:libudev1:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"e450ef05193f69e3","cpes":["cpe:2.3:a:systemd:systemd:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/debian/systemd@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.list"},{"path":"/var/lib/dpkg/info/systemd.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postinst"},{"path":"/var/lib/dpkg/info/systemd.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postrm"},{"path":"/var/lib/dpkg/info/systemd.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.preinst"},{"path":"/var/lib/dpkg/info/systemd.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.prerm"},{"path":"/var/lib/dpkg/info/systemd.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"59a35c804cdace6f","cpes":["cpe:2.3:a:systemd-sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd-sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd-sysv","purl":"pkg:deb/debian/systemd-sysv@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd-sysv/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd-sysv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.list"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"29e72562c3e4b088","cpes":["cpe:2.3:a:udev:udev:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/debian/udev@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.prerm"},{"path":"/var/lib/dpkg/info/udev.templates","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.templates"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-08","epss":0.07441,"percentile":0.94306}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-08","epss":0.04876,"percentile":0.91833}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-08","epss":0.0731,"percentile":0.94228}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"c2e5d62c27b6eb20","cpes":["cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others_project:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_othersproject:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:holger_krekel\\,_ronny_pfannschmidt\\,_benjamin_peterson_and_others:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev_project:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_devproject:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python-py:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python-py:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python_py:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python_py:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest-dev:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:pytest_dev:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:py:python-py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:py:python_py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python-py:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python_py:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:python:py:1.4.34:*:*:*:*:*:*:*","cpe:2.3:a:py:py:1.4.34:*:*:*:*:*:*:*"],"name":"py","purl":"pkg:pypi/py@1.4.34","type":"python","version":"1.4.34","language":"python","licenses":["MIT license"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/py-1.4.34.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.10.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hj5v-574p-mj7c","versionConstraint":"<1.10.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"py","version":"1.4.34"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hj5v-574p-mj7c","fix":{"state":"fixed","versions":["1.10.0"],"available":[{"date":"2021-04-22","kind":"first-observed","version":"1.10.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29651","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29651","date":"2026-10-08","epss":0.04662,"percentile":0.91512}],"risk":3.6363600000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-29651","https://github.com/pytest-dev/py/issues/256","https://github.com/pytest-dev/py/pull/257","https://github.com/pytest-dev/py/pull/257/commits/4a9017dc6199d2a564b6e4b0aa39d6d8870e4144","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/py/PYSEC-2020-92.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hj5v-574p-mj7c","description":"py vulnerable to Regular Expression Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2020-29651","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29651","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29651","date":"2026-10-08","epss":0.04662,"percentile":0.91512}],"urls":["https://github.com/pytest-dev/py/issues/256","https://github.com/pytest-dev/py/pull/257","https://github.com/pytest-dev/py/pull/257/commits/4a9017dc6199d2a564b6e4b0aa39d6d8870e4144","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR/","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29651","description":"A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-08","epss":0.04731,"percentile":0.91614}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-08","epss":0.04689,"percentile":0.91551}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2520","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2520","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-2520","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2520","date":"2026-10-08","epss":0.04643,"percentile":0.91485}],"risk":3.48225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2520"},"relatedVulnerabilities":[{"id":"CVE-2017-2520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2520","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2520","date":"2026-10-08","epss":0.04643,"percentile":0.91485}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2520","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-16056","versionConstraint":"<= 2.7.16||>= 3.0.0, <= 3.0.1||>= 3.1.0, <= 3.1.5||>= 3.2.0, <= 3.2.6||>= 3.3.0, <= 3.3.7||>= 3.4.0, <= 3.4.10||>= 3.5.0, <= 3.5.7||>= 3.6.0, <= 3.6.9||>= 3.7.0, <= 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.4389333333333334,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p49h-hjvm-jg3h","versionConstraint":"<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-p49h-hjvm-jg3h","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2021-11-04","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5312","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5312","date":"2026-10-08","epss":0.0369,"percentile":0.89409}],"risk":3.4224750000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5312","https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h","description":"PCX P mode buffer overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5312","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5312","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5312","date":"2026-10-08","epss":0.0369,"percentile":0.89409}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312","description":"libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-1061","versionConstraint":"< 2.7.15||>= 3.0, < 3.4.9||>= 3.5.0, <= 3.5.5||>= 3.6, <= 3.6.4||= 3.7.0-alpha1||= 3.7.0-alpha2||= 3.7.0-alpha3||= 3.7.0-alpha4||= 3.7.0-beta1||= 3.7.0-beta2||= 3.7.0-beta3||= 3.7.0-beta4||= 3.7.0-beta5||= 3.7.0-rc1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-1061","fix":{"state":"fixed","versions":["2.7.15","3.4.9"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.9"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1061","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1061","date":"2026-10-08","epss":0.04916,"percentile":0.91892}],"risk":3.4002333333333334,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securitytracker.com/id/1042001","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3041","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue32981","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1061","description":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"d3136b98e7a1e577","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u4:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=expat","type":"deb","version":"2.1.0-6+deb8u4","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15903","versionConstraint":"< 2.1.0-6+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"expat","version":"2.1.0-6+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"fixed","versions":["2.1.0-6+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"risk":3.3215000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15903"},"relatedVulnerabilities":[{"id":"CVE-2019-15903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-08","epss":0.06643,"percentile":0.93704}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.15"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-1060","versionConstraint":"> 3.6.0, < 3.6.5||>= 2.7.0, < 2.7.15||>= 3.0.0, < 3.4.9||>= 3.5.0, < 3.5.6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-1060","fix":{"state":"fixed","versions":["2.7.15","3.4.9","3.5.6","3.6.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.5"},{"date":"2025-09-04","kind":"first-observed","version":"2.7.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.4.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1060","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2018-1060","date":"2026-10-08","epss":0.05039,"percentile":0.9207}],"risk":3.300545,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securitytracker.com/id/1042001","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3041","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue32981","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1060","description":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.38.0-4+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.38.0-4+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u9"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-08","epss":0.06578,"percentile":0.93662}],"risk":3.289,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4098-1","link":"https://security-tracker.debian.org/tracker/DSA-4098-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-08","epss":0.06578,"percentile":0.93662}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13117","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13117","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"risk":3.2285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13117"},"relatedVulnerabilities":[{"id":"CVE-2019-13117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471","https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5631739747106816","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117","description":"In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13117","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13117","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"risk":3.2285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13117"},"relatedVulnerabilities":[{"id":"CVE-2019-13117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13117","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13117","date":"2026-10-08","epss":0.06457,"percentile":0.9356}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471","https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5631739747106816","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117","description":"In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3858","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3858","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3858","date":"2026-10-08","epss":0.06448,"percentile":0.93553}],"risk":3.2239999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3858"},"relatedVulnerabilities":[{"id":"CVE-2019-3858","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3858","date":"2026-10-08","epss":0.06448,"percentile":0.93553}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:2136","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3858","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3858.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3858","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-08","epss":0.04257,"percentile":0.90808}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"7321d398eb2e6b87","cpes":["cpe:2.3:a:hynek_schlawack_project:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack_project:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack_project:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:pyopenssl:17.2.0:*:*:*:*:*:*:*"],"name":"pyopenssl","purl":"pkg:pypi/pyopenssl@17.2.0","type":"python","version":"17.2.0","language":"python","licenses":["Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"17.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p28m-34f6-967q","versionConstraint":"<17.5.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyopenssl","version":"17.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-p28m-34f6-967q","fix":{"state":"fixed","versions":["17.5.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"17.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000807","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000807","date":"2026-10-08","epss":0.04075,"percentile":0.9043}],"risk":3.1785,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000807","https://github.com/pyca/pyopenssl/pull/723","https://access.redhat.com/errata/RHSA-2019:0085","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html","https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509","https://github.com/pypa/advisory-database/tree/main/vulns/pyopenssl/PYSEC-2018-23.yaml","https://usn.ubuntu.com/3813-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p28m-34f6-967q","description":"PyOpenSSL Use-After-Free vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2018-1000807","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000807","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000807","date":"2026-10-08","epss":0.04075,"percentile":0.9043}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html","https://access.redhat.com/errata/RHSA-2019:0085","https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509","https://github.com/pyca/pyopenssl/pull/723","https://usn.ubuntu.com/3813-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000807","description":"Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3859","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3859","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-08","epss":0.06275,"percentile":0.93405}],"risk":3.1375,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3859"},"relatedVulnerabilities":[{"id":"CVE-2019-3859","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-08","epss":0.06275,"percentile":0.93405}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00102.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00103.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3859","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/04/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3859.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3859","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.38.0-4+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.38.0-4+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-08","epss":0.06224,"percentile":0.9336}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4007-1","link":"https://security-tracker.debian.org/tracker/DSA-4007-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-08","epss":0.06224,"percentile":0.9336}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-08","epss":0.06207,"percentile":0.93343}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8vj2-vxx3-667w","versionConstraint":"<9.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8vj2-vxx3-667w","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2022-03-12","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22817","date":"2026-10-08","epss":0.03334,"percentile":0.88299}],"risk":3.0922850000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22817","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://www.debian.org/security/2022/dsa-5053","https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8vj2-vxx3-667w","description":"Arbitrary expression injection in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-22817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22817","date":"2026-10-08","epss":0.03334,"percentile":0.88299}],"urls":["https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10","https://www.debian.org/security/2022/dsa-5053"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817","description":"PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-3217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-08","epss":0.06169,"percentile":0.93305}],"risk":3.0845000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-3217"},"relatedVulnerabilities":[{"id":"CVE-2015-3217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-08","epss":0.06169,"percentile":0.93305}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-1025.html","http://rhn.redhat.com/errata/RHSA-2016-2750.html","http://vcs.pcre.org/pcre?view=revision&revision=1566","http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886","http://www.openwall.com/lists/oss-security/2015/06/03/7","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/75018","https://access.redhat.com/errata/RHSA-2016:1132","https://bugs.exim.org/show_bug.cgi?id=1638","https://bugzilla.redhat.com/show_bug.cgi?id=1228283"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3217","description":"PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3856","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3856","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3856","date":"2026-10-08","epss":0.06131,"percentile":0.93268}],"risk":3.0655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3856"},"relatedVulnerabilities":[{"id":"CVE-2019-3856","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3856","date":"2026-10-08","epss":0.06131,"percentile":0.93268}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3856.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3856","description":"An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3857","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3857","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3857","date":"2026-10-08","epss":0.06131,"percentile":0.93267}],"risk":3.0655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3857"},"relatedVulnerabilities":[{"id":"CVE-2019-3857","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3857","date":"2026-10-08","epss":0.06131,"percentile":0.93267}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3857","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3857.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3857","description":"An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c8c8-9472-w52h","versionConstraint":"<1.8.14 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-c8c8-9472-w52h","fix":{"state":"fixed","versions":["1.8.14"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6186","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6186","date":"2026-10-08","epss":0.05581,"percentile":0.9268}],"risk":2.9858349999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-6186","https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158","https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d","http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html","http://rhn.redhat.com/errata/RHSA-2016-1594.html","http://rhn.redhat.com/errata/RHSA-2016-1595.html","http://rhn.redhat.com/errata/RHSA-2016-1596.html","http://seclists.org/fulldisclosure/2016/Jul/53","http://www.debian.org/security/2016/dsa-3622","http://www.ubuntu.com/usn/USN-3039-1","http://www.vulnerability-lab.com/get_content.php?id=1869","https://web.archive.org/web/20201022155237/http://www.securityfocus.com/archive/1/538947/100/0/threaded","https://web.archive.org/web/20210123154652/http://www.securityfocus.com/bid/92058","https://web.archive.org/web/20211204042848/http://www.securitytracker.com/id/1036338","https://github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW","https://www.djangoproject.com/weblog/2016/jul/18/security-releases","https://www.exploit-db.com/exploits/40129","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c8c8-9472-w52h","description":"Django Cross-site scripting Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2016-6186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6186","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6186","date":"2026-10-08","epss":0.05581,"percentile":0.9268}],"urls":["http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html","http://rhn.redhat.com/errata/RHSA-2016-1594.html","http://rhn.redhat.com/errata/RHSA-2016-1595.html","http://rhn.redhat.com/errata/RHSA-2016-1596.html","http://seclists.org/fulldisclosure/2016/Jul/53","http://www.debian.org/security/2016/dsa-3622","http://www.securityfocus.com/archive/1/538947/100/0/threaded","http://www.securityfocus.com/bid/92058","http://www.securitytracker.com/id/1036338","http://www.ubuntu.com/usn/USN-3039-1","http://www.vulnerability-lab.com/get_content.php?id=1869","https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158","https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW/","https://www.djangoproject.com/weblog/2016/jul/18/security-releases/","https://www.exploit-db.com/exploits/40129/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6186","description":"Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-16932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"risk":2.964,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16932"},"relatedVulnerabilities":[{"id":"CVE-2017-16932","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"urls":["http://xmlsoft.org/news.html","https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","https://bugzilla.gnome.org/show_bug.cgi?id=759579","https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://usn.ubuntu.com/3739-1/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","description":"parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"risk":2.964,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16932"},"relatedVulnerabilities":[{"id":"CVE-2017-16932","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-08","epss":0.05928,"percentile":0.93071}],"urls":["http://xmlsoft.org/news.html","https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","https://bugzilla.gnome.org/show_bug.cgi?id=759579","https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://usn.ubuntu.com/3739-1/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","description":"parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2519","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2519","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2017-2519","date":"2026-10-08","epss":0.0395,"percentile":0.90144}],"risk":2.9625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2519"},"relatedVulnerabilities":[{"id":"CVE-2017-2519","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-2519","date":"2026-10-08","epss":0.0395,"percentile":0.90144}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2519","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.38.0-4+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.38.0-4+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-08","epss":0.0592,"percentile":0.9306}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4202-1","link":"https://security-tracker.debian.org/tracker/DSA-4202-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-08","epss":0.0592,"percentile":0.9306}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7534-mm45-c74v","versionConstraint":"<8.3.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-7534-mm45-c74v","fix":{"state":"fixed","versions":["8.3.0"],"available":[{"date":"2021-10-06","kind":"first-observed","version":"8.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34552","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34552","date":"2026-10-08","epss":0.03188,"percentile":0.87701}],"risk":2.95687,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-34552","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://github.com/python-pillow/Pillow/pull/5567","https://security.gentoo.org/glsa/202211-10","https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7534-mm45-c74v","description":"Buffer Overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-34552","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34552","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34552","date":"2026-10-08","epss":0.03188,"percentile":0.87701}],"urls":["https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://security.gentoo.org/glsa/202211-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552","description":"Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c."}]},{"artifact":{"id":"785ab10a54f59ffa","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"6d1d4eef8da2ed5c","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u8?arch=amd64&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"952b0053967345fe","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u8:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u8?arch=all&distro=debian-8.9&upstream=perl","type":"deb","version":"5.20.2-3+deb8u8","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"perl","version":"5.20.2-3+deb8u8"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-08","epss":0.05908,"percentile":0.93046}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"f9508e369ba1bb17","cpes":["cpe:2.3:a:celeryproject:celery:3.1.18:*:*:*:*:python:*:*"],"name":"celery","purl":"pkg:pypi/celery@3.1.18","type":"python","version":"3.1.18","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/celery-3.1.18.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xr-rc97-m4xx","versionConstraint":"<5.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"celery","version":"3.1.18"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q4xr-rc97-m4xx","fix":{"state":"fixed","versions":["5.2.2"],"available":[{"date":"2022-01-07","kind":"first-observed","version":"5.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23727","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23727","date":"2026-10-08","epss":0.03877,"percentile":0.89941}],"risk":2.927135,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23727","https://github.com/celery/celery/blob/master/Changelog.rst%23522","https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953","https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b","https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xr-rc97-m4xx","description":"OS Command Injection in celery"},"relatedVulnerabilities":[{"id":"CVE-2021-23727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23727","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23727","date":"2026-10-08","epss":0.03877,"percentile":0.89941}],"urls":["https://github.com/celery/celery/blob/master/Changelog.rst%23522","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/","https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23727","description":"This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."}]},{"artifact":{"id":"03012809dae54b0f","cpes":["cpe:2.3:a:libidn11:libidn11:1.29-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libidn11","purl":"pkg:deb/debian/libidn11@1.29-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=libidn","type":"deb","version":"1.29-1+deb8u2","language":"","licenses":["GAP","GFDL-1.3","GFDL-1.3+","GPL-2","GPL-3","GPL-3+","LGPL-2","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn11/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libidn11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn11:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libidn11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.29-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14062","versionConstraint":"< 1.29-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libidn","version":"1.29-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14062","fix":{"state":"fixed","versions":["1.29-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.29-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14062","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14062","date":"2026-10-08","epss":0.0389,"percentile":0.89974}],"risk":2.9175,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14062"},"relatedVulnerabilities":[{"id":"CVE-2017-14062","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14062","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14062","date":"2026-10-08","epss":0.0389,"percentile":0.89974}],"urls":["http://www.debian.org/security/2017/dsa-3988","https://gitlab.com/libidn/libidn2/blob/master/NEWS","https://gitlab.com/libidn/libidn2/commit/3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd","https://lists.debian.org/debian-lts-announce/2018/07/msg00040.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14062","description":"Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6323","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6323","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6323","date":"2026-10-08","epss":0.05834,"percentile":0.92979}],"risk":2.9170000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6323"},"relatedVulnerabilities":[{"id":"CVE-2018-6323","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6323","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6323","date":"2026-10-08","epss":0.05834,"percentile":0.92979}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","http://www.securityfocus.com/bid/102821","https://sourceware.org/bugzilla/show_bug.cgi?id=22746","https://www.exploit-db.com/exploits/44035/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6323","description":"The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9740","versionConstraint":">= 2.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":2.875253333333333,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5qw-4364-5hhm","versionConstraint":">=1.5,<1.7.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q5qw-4364-5hhm","fix":{"state":"fixed","versions":["1.7.9"],"available":[{"date":"2023-08-05","kind":"first-observed","version":"1.7.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5144","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5144","date":"2026-10-08","epss":0.03665,"percentile":0.89342}],"risk":2.8587000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5144","https://security.gentoo.org/glsa/201510-06","http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.ubuntu.com/usn/USN-2671-1","https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a","https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0","https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649","https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54","https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820","https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665","https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c","https://www.djangoproject.com/weblog/2015/jul/08/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5qw-4364-5hhm","description":"Django Vulnerable to HTTP Response Splitting Attack"},"relatedVulnerabilities":[{"id":"CVE-2015-5144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5144","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5144","date":"2026-10-08","epss":0.03665,"percentile":0.89342}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.securityfocus.com/bid/75665","http://www.securitytracker.com/id/1032820","http://www.ubuntu.com/usn/USN-2671-1","https://security.gentoo.org/glsa/201510-06","https://www.djangoproject.com/weblog/2015/jul/08/security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5144","description":"Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-19956","versionConstraint":"< 2.9.1+dfsg1-5+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19956","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"risk":2.78,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19956"},"relatedVulnerabilities":[{"id":"CVE-2019-19956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549","https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.netapp.com/advisory/ntap-20200114-0002/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","description":"xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19956","versionConstraint":"< 2.9.1+dfsg1-5+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19956","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"risk":2.78,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19956"},"relatedVulnerabilities":[{"id":"CVE-2019-19956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-08","epss":0.0556,"percentile":0.92652}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549","https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.netapp.com/advisory/ntap-20200114-0002/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","description":"xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-17522","versionConstraint":"<= 3.6.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-17522","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17522","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-17522","date":"2026-10-08","epss":0.03595,"percentile":0.89136}],"risk":2.750175,"urls":["http://www.securityfocus.com/bid/102207","https://bugs.python.org/issue32367","https://security-tracker.debian.org/tracker/CVE-2017-17522"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17522","description":"Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting"},"relatedVulnerabilities":[]},{"artifact":{"id":"766218805d7dd9d0","cpes":["cpe:2.3:a:httplib2_project:httplib2:0.10.3:*:*:*:*:python:*:*","cpe:2.3:a:httplib2_project:httplib2:0.10.3:*:*:*:*:*:*:*"],"name":"httplib2","purl":"pkg:pypi/httplib2@0.10.3","type":"python","version":"0.10.3","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.19.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93xj-8mrv-444m","versionConstraint":"<0.19.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"httplib2","version":"0.10.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-93xj-8mrv-444m","fix":{"state":"fixed","versions":["0.19.0"],"available":[{"date":"2021-02-09","kind":"first-observed","version":"0.19.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21240","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2021-21240","date":"2026-10-08","epss":0.03626,"percentile":0.89225}],"risk":2.73763,"urls":["https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","https://github.com/httplib2/httplib2/pull/182","https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc","https://nvd.nist.gov/vuln/detail/CVE-2021-21240","https://pypi.org/project/httplib2","https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2021-16.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93xj-8mrv-444m","description":"Regular Expression Denial of Service (REDoS) in httplib2"},"relatedVulnerabilities":[{"id":"CVE-2021-21240","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21240","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2021-21240","date":"2026-10-08","epss":0.03626,"percentile":0.89225}],"urls":["https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc","https://github.com/httplib2/httplib2/pull/182","https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","https://pypi.org/project/httplib2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-9947","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.9","3.7.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.69654,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16890","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16890","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-08","epss":0.05351,"percentile":0.9243}],"risk":2.6755,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16890"},"relatedVulnerabilities":[{"id":"CVE-2018-16890","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-08","epss":0.05351,"percentile":0.9243}],"urls":["http://www.securityfocus.com/bid/106947","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-16890.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0001/","https://support.f5.com/csp/article/K03314397?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","description":"libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9842","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9842"},"relatedVulnerabilities":[{"id":"CVE-2016-9842","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9842","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9842"},"relatedVulnerabilities":[{"id":"CVE-2016-9842","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-08","epss":0.05204,"percentile":0.92272}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13118","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13118","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"risk":2.5945,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13118"},"relatedVulnerabilities":[{"id":"CVE-2019-13118","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://seclists.org/fulldisclosure/2019/Aug/11","http://seclists.org/fulldisclosure/2019/Aug/13","http://seclists.org/fulldisclosure/2019/Aug/14","http://seclists.org/fulldisclosure/2019/Aug/15","http://seclists.org/fulldisclosure/2019/Jul/22","http://seclists.org/fulldisclosure/2019/Jul/23","http://seclists.org/fulldisclosure/2019/Jul/24","http://seclists.org/fulldisclosure/2019/Jul/26","http://seclists.org/fulldisclosure/2019/Jul/31","http://seclists.org/fulldisclosure/2019/Jul/37","http://seclists.org/fulldisclosure/2019/Jul/38","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069","https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5197371471822848","https://seclists.org/bugtraq/2019/Aug/21","https://seclists.org/bugtraq/2019/Aug/22","https://seclists.org/bugtraq/2019/Aug/23","https://seclists.org/bugtraq/2019/Aug/25","https://seclists.org/bugtraq/2019/Jul/35","https://seclists.org/bugtraq/2019/Jul/36","https://seclists.org/bugtraq/2019/Jul/37","https://seclists.org/bugtraq/2019/Jul/40","https://seclists.org/bugtraq/2019/Jul/41","https://seclists.org/bugtraq/2019/Jul/42","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://support.apple.com/kb/HT210346","https://support.apple.com/kb/HT210348","https://support.apple.com/kb/HT210351","https://support.apple.com/kb/HT210353","https://support.apple.com/kb/HT210356","https://support.apple.com/kb/HT210357","https://support.apple.com/kb/HT210358","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118","description":"In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13118","versionConstraint":"< 1.1.28-2+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13118","fix":{"state":"fixed","versions":["1.1.28-2+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"risk":2.5945,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13118"},"relatedVulnerabilities":[{"id":"CVE-2019-13118","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13118","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13118","date":"2026-10-08","epss":0.05189,"percentile":0.92255}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://seclists.org/fulldisclosure/2019/Aug/11","http://seclists.org/fulldisclosure/2019/Aug/13","http://seclists.org/fulldisclosure/2019/Aug/14","http://seclists.org/fulldisclosure/2019/Aug/15","http://seclists.org/fulldisclosure/2019/Jul/22","http://seclists.org/fulldisclosure/2019/Jul/23","http://seclists.org/fulldisclosure/2019/Jul/24","http://seclists.org/fulldisclosure/2019/Jul/26","http://seclists.org/fulldisclosure/2019/Jul/31","http://seclists.org/fulldisclosure/2019/Jul/37","http://seclists.org/fulldisclosure/2019/Jul/38","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069","https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","https://oss-fuzz.com/testcase-detail/5197371471822848","https://seclists.org/bugtraq/2019/Aug/21","https://seclists.org/bugtraq/2019/Aug/22","https://seclists.org/bugtraq/2019/Aug/23","https://seclists.org/bugtraq/2019/Aug/25","https://seclists.org/bugtraq/2019/Jul/35","https://seclists.org/bugtraq/2019/Jul/36","https://seclists.org/bugtraq/2019/Jul/37","https://seclists.org/bugtraq/2019/Jul/40","https://seclists.org/bugtraq/2019/Jul/41","https://seclists.org/bugtraq/2019/Jul/42","https://security.netapp.com/advisory/ntap-20190806-0004/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://support.apple.com/kb/HT210346","https://support.apple.com/kb/HT210348","https://support.apple.com/kb/HT210351","https://support.apple.com/kb/HT210353","https://support.apple.com/kb/HT210356","https://support.apple.com/kb/HT210357","https://support.apple.com/kb/HT210358","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118","description":"In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data."}]},{"artifact":{"id":"e6018bed8eee8681","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.19-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10915","versionConstraint":"< 9.4.19-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10915","fix":{"state":"fixed","versions":["9.4.19-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.19-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10915","date":"2026-10-08","epss":0.05154,"percentile":0.92215}],"risk":2.577,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10915"},"relatedVulnerabilities":[{"id":"CVE-2018-10915","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10915","date":"2026-10-08","epss":0.05154,"percentile":0.92215}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html","http://www.securityfocus.com/bid/105054","http://www.securitytracker.com/id/1041446","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2557","https://access.redhat.com/errata/RHSA-2018:2565","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2721","https://access.redhat.com/errata/RHSA-2018:2729","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915","https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html","https://security.gentoo.org/glsa/201810-08","https://usn.ubuntu.com/3744-1/","https://www.debian.org/security/2018/dsa-4269","https://www.postgresql.org/about/news/1878/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10915","description":"A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."}]},{"artifact":{"id":"129495beb6b7ad25","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.19-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10915","versionConstraint":"< 9.4.19-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10915","fix":{"state":"fixed","versions":["9.4.19-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.19-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10915","date":"2026-10-08","epss":0.05154,"percentile":0.92215}],"risk":2.577,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10915"},"relatedVulnerabilities":[{"id":"CVE-2018-10915","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10915","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10915","date":"2026-10-08","epss":0.05154,"percentile":0.92215}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html","http://www.securityfocus.com/bid/105054","http://www.securitytracker.com/id/1041446","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2557","https://access.redhat.com/errata/RHSA-2018:2565","https://access.redhat.com/errata/RHSA-2018:2566","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2721","https://access.redhat.com/errata/RHSA-2018:2729","https://access.redhat.com/errata/RHSA-2018:3816","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915","https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html","https://security.gentoo.org/glsa/201810-08","https://usn.ubuntu.com/3744-1/","https://www.debian.org/security/2018/dsa-4269","https://www.postgresql.org/about/news/1878/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10915","description":"A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-08","epss":0.51298,"percentile":0.98913}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3860","versionConstraint":"< 1.4.3-4.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3860","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"risk":2.559,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3860"},"relatedVulnerabilities":[{"id":"CVE-2019-3860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3860.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3860","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3861","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3861","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3861","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"risk":2.559,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3861"},"relatedVulnerabilities":[{"id":"CVE-2019-3861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3861","date":"2026-10-08","epss":0.05118,"percentile":0.92169}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:2136","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3861","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3861.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3861","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9746","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9746","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9746","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"risk":2.5518,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9746"},"relatedVulnerabilities":[{"id":"CVE-2017-9746","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9746","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9746","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"urls":["http://www.securityfocus.com/bid/99117","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21580","https://www.exploit-db.com/exploits/42199/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9746","description":"The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9749","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9749","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9749","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9749","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"risk":2.5518,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9749"},"relatedVulnerabilities":[{"id":"CVE-2017-9749","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9749","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9749","date":"2026-10-08","epss":0.08506,"percentile":0.94911}],"urls":["http://www.securityfocus.com/bid/99113","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21586","https://www.exploit-db.com/exploits/42201/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9749","description":"The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-08","epss":0.05033,"percentile":0.92053}],"risk":2.5165,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7186"},"relatedVulnerabilities":[{"id":"CVE-2017-7186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-08","epss":0.05033,"percentile":0.92053}],"urls":["http://www.securityfocus.com/bid/97030","https://access.redhat.com/errata/RHSA-2018:2486","https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/","https://bugs.exim.org/show_bug.cgi?id=2052","https://security.gentoo.org/glsa/201710-09","https://security.gentoo.org/glsa/201710-25","https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date","https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7186","description":"libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup."}]},{"artifact":{"id":"1d874d9e274a62d4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u3","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13565","versionConstraint":"< 2.4.40+dfsg-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13565","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-08","epss":0.05015,"percentile":0.92033}],"risk":2.5075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13565"},"relatedVulnerabilities":[{"id":"CVE-2019-13565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-08","epss":0.05015,"percentile":0.92033}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://seclists.org/fulldisclosure/2019/Dec/26","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","https://seclists.org/bugtraq/2019/Dec/23","https://support.apple.com/kb/HT210788","https://support.f5.com/csp/article/K98008862?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4078-1/","https://usn.ubuntu.com/4078-2/","https://www.openldap.org/its/index.cgi/?findid=9052","https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user."}]},{"artifact":{"id":"5bb209255b1ff2bc","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.2-3\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.2-3\\+deb8u3:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/debian/libtasn1-6@4.2-3%2Bdeb8u3?arch=amd64&distro=debian-8.9","type":"deb","version":"4.2-3+deb8u3","language":"","licenses":["sha256:7faa7a2e10c1267fe75183ec4f0d556d78d9630f29e1a7e704d1f6d67041216f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2-3+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-10790","versionConstraint":"< 4.2-3+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libtasn1-6","version":"4.2-3+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10790","fix":{"state":"fixed","versions":["4.2-3+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.2-3+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"risk":2.495,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10790"},"relatedVulnerabilities":[{"id":"CVE-2017-10790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-08","epss":0.0499,"percentile":0.92004}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464141","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00026.html","https://security.gentoo.org/glsa/201710-11","https://usn.ubuntu.com/3547-1/","https://www.debian.org/security/2018/dsa-4106"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10790","description":"The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack."}]},{"artifact":{"id":"eb3307d2038e01a5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.0.3","type":"python","version":"2.0.3","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fcf9-3qw3-gxmj","versionConstraint":">=1.9.0,<2.3 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.0.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-fcf9-3qw3-gxmj","fix":{"state":"fixed","versions":["2.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10903","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10903","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10903","date":"2026-10-08","epss":0.03196,"percentile":0.87737}],"risk":2.49288,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-10903","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903","https://github.com/pyca/cryptography/pull/4342","https://github.com/pyca/cryptography/commit/d4378e42937b56f473ddade2667f919ce32208cb","https://access.redhat.com/errata/RHSA-2018:3600","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2018-52.yaml","https://usn.ubuntu.com/3720-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fcf9-3qw3-gxmj","description":"PyCA Cryptography vulnerable to GCM tag forgery"},"relatedVulnerabilities":[{"id":"CVE-2018-10903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10903","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10903","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10903","date":"2026-10-08","epss":0.03196,"percentile":0.87737}],"urls":["https://access.redhat.com/errata/RHSA-2018:3600","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903","https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19ef","https://usn.ubuntu.com/3720-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10903","description":"A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f4w8-cv6p-x6r5","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-f4w8-cv6p-x6r5","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27921","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27921","date":"2026-10-08","epss":0.0317,"percentile":0.87643}],"risk":2.4726000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27921","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-40.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5","description":"Pillow Denial of Service by Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27921","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27921","date":"2026-10-08","epss":0.0317,"percentile":0.87643}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27921","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.17"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-16935","versionConstraint":">= 2.7.0, < 2.7.17||>= 3.0.0, < 3.5.8||>= 3.6.0, < 3.6.10||>= 3.7.0, < 3.7.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["2.7.17","3.5.8","3.6.10","3.7.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"2.7.17"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":2.442825,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j7mj-748x-7p78","versionConstraint":"<6.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j7mj-748x-7p78","fix":{"state":"fixed","versions":["6.2.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16865","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16865","date":"2026-10-08","epss":0.03128,"percentile":0.87478}],"risk":2.4398400000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16865","https://github.com/python-pillow/Pillow/issues/4123","https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://www.debian.org/security/2020/dsa-4631","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3","https://ubuntu.com/security/notices/USN-4272-1","https://usn.ubuntu.com/4272-1","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j7mj-748x-7p78","description":"DOS attack in Pillow when processing specially crafted image files"},"relatedVulnerabilities":[{"id":"CVE-2019-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16865","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16865","date":"2026-10-08","epss":0.03128,"percentile":0.87478}],"urls":["https://access.redhat.com/errata/RHSA-2020:0566","https://access.redhat.com/errata/RHSA-2020:0578","https://access.redhat.com/errata/RHSA-2020:0580","https://access.redhat.com/errata/RHSA-2020:0681","https://access.redhat.com/errata/RHSA-2020:0683","https://access.redhat.com/errata/RHSA-2020:0694","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image."}]},{"artifact":{"id":"9ae831ac601e663e","cpes":["cpe:2.3:a:sqlparse_project:sqlparse:0.1.19:*:*:*:*:python:*:*"],"name":"sqlparse","purl":"pkg:pypi/sqlparse@0.1.19","type":"python","version":"0.1.19","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/sqlparse-0.1.19-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2m57-hf25-phgg","versionConstraint":"<0.5.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"sqlparse","version":"0.1.19"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-2m57-hf25-phgg","fix":{"state":"fixed","versions":["0.5.0"],"available":[{"date":"2024-04-16","kind":"first-observed","version":"0.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4340","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-4340","date":"2026-10-08","epss":0.03237,"percentile":0.87912}],"risk":2.42775,"urls":["https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg","https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03","https://nvd.nist.gov/vuln/detail/CVE-2024-4340","https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2m57-hf25-phgg","description":"sqlparse parsing heavily nested list leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2024-4340","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4340","cwe":"CWE-674","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-4340","date":"2026-10-08","epss":0.03237,"percentile":0.87912}],"urls":["https://github.com/advisories/GHSA-2m57-hf25-phgg","https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03","https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/","https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4340","description":"Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9750","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9750","date":"2026-10-08","epss":0.08075,"percentile":0.94668}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9750"},"relatedVulnerabilities":[{"id":"CVE-2017-9750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9750","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9750","date":"2026-10-08","epss":0.08075,"percentile":0.94668}],"urls":["http://www.securityfocus.com/bid/99118","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21587","https://www.exploit-db.com/exploits/42198/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9750","description":"opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9742","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9742","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9742","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9742","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9742"},"relatedVulnerabilities":[{"id":"CVE-2017-9742","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9742","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9742","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"urls":["http://www.securityfocus.com/bid/99105","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21576","https://www.exploit-db.com/exploits/42203/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9742","description":"The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9756","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9756","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9756","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"risk":2.4225,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9756"},"relatedVulnerabilities":[{"id":"CVE-2017-9756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9756","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9756","date":"2026-10-08","epss":0.08075,"percentile":0.94667}],"urls":["http://www.securityfocus.com/bid/99103","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21595","https://www.exploit-db.com/exploits/42204/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9756","description":"The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution."}]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11212","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11212","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"risk":2.416,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11212"},"relatedVulnerabilities":[{"id":"CVE-2018-11212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.ijg.org/","http://www.securityfocus.com/bid/106583","https://access.redhat.com/errata/RHSA-2019:0469","https://access.redhat.com/errata/RHSA-2019:0472","https://access.redhat.com/errata/RHSA-2019:0473","https://access.redhat.com/errata/RHSA-2019:0474","https://access.redhat.com/errata/RHSA-2019:0640","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://security.netapp.com/advisory/ntap-20190118-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11212","description":"An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11212","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11212","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"risk":2.416,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11212"},"relatedVulnerabilities":[{"id":"CVE-2018-11212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.ijg.org/","http://www.securityfocus.com/bid/106583","https://access.redhat.com/errata/RHSA-2019:0469","https://access.redhat.com/errata/RHSA-2019:0472","https://access.redhat.com/errata/RHSA-2019:0473","https://access.redhat.com/errata/RHSA-2019:0474","https://access.redhat.com/errata/RHSA-2019:0640","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://security.netapp.com/advisory/ntap-20190118-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11212","description":"An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11212","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11212","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"risk":2.416,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11212"},"relatedVulnerabilities":[{"id":"CVE-2018-11212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11212","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11212","date":"2026-10-08","epss":0.04832,"percentile":0.91765}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.ijg.org/","http://www.securityfocus.com/bid/106583","https://access.redhat.com/errata/RHSA-2019:0469","https://access.redhat.com/errata/RHSA-2019:0472","https://access.redhat.com/errata/RHSA-2019:0473","https://access.redhat.com/errata/RHSA-2019:0474","https://access.redhat.com/errata/RHSA-2019:0640","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://security.netapp.com/advisory/ntap-20190118-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11212","description":"An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-77gc-v2xv-rvvh","versionConstraint":">=2.4.0,<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-77gc-v2xv-rvvh","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25287","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25287","date":"2026-10-08","epss":0.02931,"percentile":0.86682}],"risk":2.4107475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25287","https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh","description":"Out-of-bounds Read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25287","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25287","date":"2026-10-08","epss":0.02931,"percentile":0.86682}],"urls":["https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25287","description":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pw27-w7w4-9qc7","versionConstraint":"<1.8.10 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pw27-w7w4-9qc7","fix":{"state":"fixed","versions":["1.8.10"],"available":[{"date":"2023-08-01","kind":"first-observed","version":"1.8.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2512","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2512","date":"2026-10-08","epss":0.04053,"percentile":0.90384}],"risk":2.4014024999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-2512","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://web.archive.org/web/20210123090815/http://www.securityfocus.com/bid/83879","https://web.archive.org/web/20210413200202/http://www.securitytracker.com/id/1035152","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350","https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380","https://www.djangoproject.com/weblog/2016/mar/01/security-releases","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-15.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pw27-w7w4-9qc7","description":"Django XSS Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2016-2512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2512","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2512","date":"2026-10-08","epss":0.04053,"percentile":0.90384}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-0502.html","http://rhn.redhat.com/errata/RHSA-2016-0504.html","http://rhn.redhat.com/errata/RHSA-2016-0505.html","http://rhn.redhat.com/errata/RHSA-2016-0506.html","http://www.debian.org/security/2016/dsa-3544","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/bid/83879","http://www.securitytracker.com/id/1035152","http://www.ubuntu.com/usn/USN-2915-1","http://www.ubuntu.com/usn/USN-2915-2","http://www.ubuntu.com/usn/USN-2915-3","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://www.djangoproject.com/weblog/2016/mar/01/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9840","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9840","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"risk":2.3965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9840"},"relatedVulnerabilities":[{"id":"CVE-2016-9840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402345","https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9840","description":"inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"a26ad6272accfa35","cpes":["cpe:2.3:a:zlib1g-dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g-dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g_dev:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g-dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:zlib1g:zlib1g_dev:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g-dev","purl":"pkg:deb/debian/zlib1g-dev@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.9&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/zlib1g-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/zlib1g-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9840","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9840","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"risk":2.3965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9840"},"relatedVulnerabilities":[{"id":"CVE-2016-9840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9840","date":"2026-10-08","epss":0.04793,"percentile":0.91709}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402345","https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9840","description":"inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.14"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.6.14||>= 3.7.0, < 3.7.11||>= 3.8.0, < 3.8.10||>= 3.9.0, < 3.9.5||= 3.10.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.6.14","3.7.11","3.8.10","3.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.14"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.3959374999999996,"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-95q3-8gr9-gm8w","versionConstraint":"<8.1.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-95q3-8gr9-gm8w","fix":{"state":"fixed","versions":["8.1.2"],"available":[{"date":"2025-08-15","kind":"first-observed","version":"8.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27923","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27923","date":"2026-10-08","epss":0.03045,"percentile":0.87146}],"risk":2.3751,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-27923","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-42.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w","description":"Pillow Denial of Service by Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2021-27923","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27923","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27923","date":"2026-10-08","epss":0.03045,"percentile":0.87146}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","https://security.gentoo.org/glsa/202107-33","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27923","description":"Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9586","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9586","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9586","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9586","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9586","date":"2026-10-08","epss":0.04746,"percentile":0.91639}],"risk":2.373,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9586"},"relatedVulnerabilities":[{"id":"CVE-2016-9586","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9586","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9586","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9586","date":"2026-10-08","epss":0.04746,"percentile":0.91639}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95019","http://www.securitytracker.com/id/1037515","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586","https://curl.haxx.se/docs/adv_20161221A.html","https://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201701-47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9586","description":"curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0735","versionConstraint":"< 1.0.1t-1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"risk":2.3619999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0735"},"relatedVulnerabilities":[{"id":"CVE-2018-0735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"urls":["http://www.securityfocus.com/bid/105750","http://www.securitytracker.com/id/1041986","https://access.redhat.com/errata/RHSA-2019:3700","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4","https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.openssl.org/news/secadv/20181029.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0735","description":"The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0735","versionConstraint":"< 1.0.1t-1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"risk":2.3619999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0735"},"relatedVulnerabilities":[{"id":"CVE-2018-0735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"urls":["http://www.securityfocus.com/bid/105750","http://www.securitytracker.com/id/1041986","https://access.redhat.com/errata/RHSA-2019:3700","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4","https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.openssl.org/news/secadv/20181029.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0735","description":"The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0735","versionConstraint":"< 1.0.1t-1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"risk":2.3619999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0735"},"relatedVulnerabilities":[{"id":"CVE-2018-0735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0735","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0735","date":"2026-10-08","epss":0.04724,"percentile":0.91602}],"urls":["http://www.securityfocus.com/bid/105750","http://www.securitytracker.com/id/1041986","https://access.redhat.com/errata/RHSA-2019:3700","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4","https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.openssl.org/news/secadv/20181029.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0735","description":"The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1)."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9747","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9747","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"risk":2.3577,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9747"},"relatedVulnerabilities":[{"id":"CVE-2017-9747","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9747","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9747","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"urls":["http://www.securityfocus.com/bid/99114","https://sourceware.org/bugzilla/show_bug.cgi?id=21581","https://www.exploit-db.com/exploits/42200/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9747","description":"The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9748","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9748","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"risk":2.3577,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9748"},"relatedVulnerabilities":[{"id":"CVE-2017-9748","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9748","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9748","date":"2026-10-08","epss":0.07859,"percentile":0.94555}],"urls":["http://www.securityfocus.com/bid/99110","https://sourceware.org/bugzilla/show_bug.cgi?id=21582","https://www.exploit-db.com/exploits/42202/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9748","description":"The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug."}]},{"artifact":{"id":"340e22ea277765e1","cpes":["cpe:2.3:a:python_virtualenv_project:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv_project:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv_project:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:9.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@9.0.1","type":"python","version":"9.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/METADATA","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/RECORD","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/top_level.txt","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"19.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gpvv-69j7-gwj8","versionConstraint":"<19.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"9.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gpvv-69j7-gwj8","fix":{"state":"fixed","versions":["19.2"],"available":[{"date":"2021-06-10","kind":"first-observed","version":"19.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20916","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20916","date":"2026-10-08","epss":0.03003,"percentile":0.86987}],"risk":2.34234,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-20916","https://github.com/pypa/pip/issues/6413","https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace","https://github.com/pypa/pip/compare/19.1.1...19.2","https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2020-173.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gpvv-69j7-gwj8","description":"Path Traversal in pip"},"relatedVulnerabilities":[{"id":"CVE-2019-20916","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20916","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20916","date":"2026-10-08","epss":0.03003,"percentile":0.86987}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html","https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace","https://github.com/pypa/pip/compare/19.1.1...19.2","https://github.com/pypa/pip/issues/6413","https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20916","description":"The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py."}]},{"artifact":{"id":"e9bcfc704cee792c","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"8f4ff33619882fd1","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"a1c91ab754578fc9","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"d12534a6470be934","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"dd7de04c6f6544ab","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3120","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3120","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"risk":2.31,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3120"},"relatedVulnerabilities":[{"id":"CVE-2016-3120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3120","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3120","date":"2026-10-08","epss":0.0462,"percentile":0.91455}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458","http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://web.mit.edu/kerberos/krb5-1.13/","http://web.mit.edu/kerberos/krb5-1.14/","http://www.securityfocus.com/bid/92132","http://www.securitytracker.com/id/1036442","https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3120","description":"The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request."}]},{"artifact":{"id":"12b1ddfd0a9b8177","cpes":["cpe:2.3:a:python:urllib3:1.16:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.16","type":"python","version":"1.16","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.24.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mh33-7rrq-662w","versionConstraint":"<1.24.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.16"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-mh33-7rrq-662w","fix":{"state":"fixed","versions":["1.24.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.24.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11324","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11324","date":"2026-10-08","epss":0.02915,"percentile":0.86606}],"risk":2.2737,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-11324","https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://www.openwall.com/lists/oss-security/2019/04/19/1","https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-133.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2","https://pypi.org/project/urllib3/1.24.2","https://usn.ubuntu.com/3990-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mh33-7rrq-662w","description":"Improper Certificate Validation in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2019-11324","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-11324","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-11324","date":"2026-10-08","epss":0.02915,"percentile":0.86606}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://www.openwall.com/lists/oss-security/2019/04/19/1","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/","https://usn.ubuntu.com/3990-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-11324","description":"The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-43fq-w8qq-v88h","versionConstraint":"<7.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-43fq-w8qq-v88h","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11538","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11538","date":"2026-10-08","epss":0.02514,"percentile":0.84326}],"risk":2.2186049999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-11538","https://github.com/python-pillow/Pillow/pull/4504","https://github.com/python-pillow/Pillow/pull/4538","https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d","https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","https://usn.ubuntu.com/4430-1","https://usn.ubuntu.com/4430-2"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-43fq-w8qq-v88h","description":"Out-of-bounds read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-11538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11538","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11538","date":"2026-10-08","epss":0.02514,"percentile":0.84326}],"urls":["https://github.com/python-pillow/Pillow/pull/4504","https://github.com/python-pillow/Pillow/pull/4538","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://usn.ubuntu.com/4430-1/","https://usn.ubuntu.com/4430-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11538","description":"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9j59-75qj-795w","versionConstraint":"<9.0.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-9j59-75qj-795w","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2022-03-12","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24303","date":"2026-10-08","epss":0.02691,"percentile":0.85449}],"risk":2.2133475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24303","https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml","https://security.gentoo.org/glsa/202211-10","https://github.com/python-pillow/Pillow/pull/6010","https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781","https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a","https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP","https://github.com/python-pillow/Pillow/pull/3450"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9j59-75qj-795w","description":"Path traversal in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-24303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24303","date":"2026-10-08","epss":0.02691,"percentile":0.85449}],"urls":["https://github.com/python-pillow/Pillow/pull/3450","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","https://security.gentoo.org/glsa/202211-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303","description":"Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1387","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1387","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"risk":2.213,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1387"},"relatedVulnerabilities":[{"id":"CVE-2019-1387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2019:4356","https://access.redhat.com/errata/RHSA-2020:0002","https://access.redhat.com/errata/RHSA-2020:0124","https://access.redhat.com/errata/RHSA-2020:0228","https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1387","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1387","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1387","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"risk":2.213,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1387"},"relatedVulnerabilities":[{"id":"CVE-2019-1387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1387","date":"2026-10-08","epss":0.04426,"percentile":0.91121}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2019:4356","https://access.redhat.com/errata/RHSA-2020:0002","https://access.redhat.com/errata/RHSA-2020:0124","https://access.redhat.com/errata/RHSA-2020:0228","https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1387","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones."}]},{"artifact":{"id":"1d874d9e274a62d4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u3:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u3","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12243","versionConstraint":"< 2.4.40+dfsg-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12243","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"risk":2.2115,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12243"},"relatedVulnerabilities":[{"id":"CVE-2020-12243","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html","https://bugs.openldap.org/show_bug.cgi?id=9202","https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES","https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440","https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html","https://security.netapp.com/advisory/ntap-20200511-0003/","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4352-1/","https://usn.ubuntu.com/4352-2/","https://www.debian.org/security/2020/dsa-4666","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-11233","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11233","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11233","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11233","date":"2026-10-08","epss":0.04408,"percentile":0.91084}],"risk":2.204,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11233"},"relatedVulnerabilities":[{"id":"CVE-2018-11233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11233","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11233","date":"2026-10-08","epss":0.04408,"percentile":0.91084}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104346","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:2147","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11233","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11233","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11233","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11233","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11233","date":"2026-10-08","epss":0.04408,"percentile":0.91084}],"risk":2.204,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11233"},"relatedVulnerabilities":[{"id":"CVE-2018-11233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11233","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11233","date":"2026-10-08","epss":0.04408,"percentile":0.91084}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104346","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:2147","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11233","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory."}]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3616","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3616","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"risk":2.1965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3616"},"relatedVulnerabilities":[{"id":"CVE-2016-3616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://bugzilla.redhat.com/show_bug.cgi?id=1318509","https://bugzilla.redhat.com/show_bug.cgi?id=1319661","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3616","description":"The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3616","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3616","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"risk":2.1965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3616"},"relatedVulnerabilities":[{"id":"CVE-2016-3616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://bugzilla.redhat.com/show_bug.cgi?id=1318509","https://bugzilla.redhat.com/show_bug.cgi?id=1319661","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3616","description":"The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3616","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3616","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"risk":2.1965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3616"},"relatedVulnerabilities":[{"id":"CVE-2016-3616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3616","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3616","date":"2026-10-08","epss":0.04393,"percentile":0.91065}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://bugzilla.redhat.com/show_bug.cgi?id=1318509","https://bugzilla.redhat.com/show_bug.cgi?id=1319661","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3616","description":"The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file."}]},{"artifact":{"id":"5bfb5d1fc593c27b","cpes":["cpe:2.3:a:libxslt1-dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1-dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1_dev:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1-dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libxslt1:libxslt1_dev:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1-dev","purl":"pkg:deb/debian/libxslt1-dev@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-18197","versionConstraint":"< 1.1.28-2+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-18197","fix":{"state":"fixed","versions":["1.1.28-2+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"risk":2.181,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-18197"},"relatedVulnerabilities":[{"id":"CVE-2019-18197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://access.redhat.com/errata/RHSA-2020:0514","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914","https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285","https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html","https://security.netapp.com/advisory/ntap-20191031-0004/","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197","description":"In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed."}]},{"artifact":{"id":"c20a3ff81dfaf668","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2\\+deb8u3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/debian/libxslt1.1@1.1.28-2%2Bdeb8u3?arch=amd64&distro=debian-8.9&upstream=libxslt","type":"deb","version":"1.1.28-2+deb8u3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.28-2+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-18197","versionConstraint":"< 1.1.28-2+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxslt","version":"1.1.28-2+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-18197","fix":{"state":"fixed","versions":["1.1.28-2+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.28-2+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"risk":2.181,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-18197"},"relatedVulnerabilities":[{"id":"CVE-2019-18197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18197","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2019-18197","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18197","date":"2026-10-08","epss":0.04362,"percentile":0.90996}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","http://www.openwall.com/lists/oss-security/2019/11/17/2","https://access.redhat.com/errata/RHSA-2020:0514","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914","https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285","https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html","https://security.netapp.com/advisory/ntap-20191031-0004/","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4164-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197","description":"In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57h3-9rgr-c24m","versionConstraint":">=0,<8.1.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-57h3-9rgr-c24m","fix":{"state":"fixed","versions":["8.1.1"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"8.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25289","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25289","date":"2026-10-08","epss":0.02345,"percentile":0.83136}],"risk":2.1749875,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25289","https://github.com/python-pillow/Pillow/commit/3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-35.yaml"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57h3-9rgr-c24m","description":"Out of bounds write in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25289","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25289","date":"2026-10-08","epss":0.02345,"percentile":0.83136}],"urls":["https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25289","description":"An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16997","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"risk":2.17125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16997"},"relatedVulnerabilities":[{"id":"CVE-2017-16997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16997","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16997","date":"2026-10-08","epss":0.02895,"percentile":0.86512}],"urls":["http://www.securityfocus.com/bid/102228","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://bugs.debian.org/884615","https://sourceware.org/bugzilla/show_bug.cgi?id=22625","https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","description":"elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2226","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2226","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2226","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2226","date":"2026-10-08","epss":0.07234,"percentile":0.94177}],"risk":2.1702,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2226"},"relatedVulnerabilities":[{"id":"CVE-2016-2226","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2226","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2226","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2226","date":"2026-10-08","epss":0.07234,"percentile":0.94177}],"urls":["http://www.openwall.com/lists/oss-security/2016/05/05/5","http://www.securityfocus.com/bid/90103","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687","https://www.exploit-db.com/exploits/42386/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11655","versionConstraint":"< 3.8.7.1-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11655","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11655","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11655","date":"2026-10-08","epss":0.0434,"percentile":0.90952}],"risk":2.17,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11655"},"relatedVulnerabilities":[{"id":"CVE-2020-11655","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11655","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11655","date":"2026-10-08","epss":0.0434,"percentile":0.90952}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc","https://security.gentoo.org/glsa/202007-26","https://security.netapp.com/advisory/ntap-20200416-0001/","https://usn.ubuntu.com/4394-1/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-14","https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11","https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11655","description":"SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8625","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8625","date":"2026-10-08","epss":0.04321,"percentile":0.90916}],"risk":2.1605,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8625"},"relatedVulnerabilities":[{"id":"CVE-2016-8625","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8625","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8625","date":"2026-10-08","epss":0.04321,"percentile":0.90916}],"urls":["http://www.securityfocus.com/bid/94107","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625","https://curl.haxx.se/CVE-2016-8625.patch","https://curl.haxx.se/docs/adv_20161102K.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8625","description":"curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host."}]},{"artifact":{"id":"94eee2f052d8b91f","cpes":["cpe:2.3:a:lxml:lxml:3.8.0:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@3.8.0","type":"python","version":"3.8.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jq4v-f5q6-mjqq","versionConstraint":"<4.6.3 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"3.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-jq4v-f5q6-mjqq","fix":{"state":"fixed","versions":["4.6.3"],"available":[{"date":"2021-03-23","kind":"first-observed","version":"4.6.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28957","date":"2026-10-08","epss":0.04035,"percentile":0.90344}],"risk":2.1587249999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28957","https://github.com/lxml/lxml/pull/316","https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d","https://bugs.launchpad.net/lxml/+bug/1888153","https://pypi.org/project/lxml","https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://www.debian.org/security/2021/dsa-4880","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.gentoo.org/glsa/202208-06","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ","https://security.netapp.com/advisory/ntap-20210521-0004"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jq4v-f5q6-mjqq","description":"lxml vulnerable to Cross-Site Scripting"},"relatedVulnerabilities":[{"id":"CVE-2021-28957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28957","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28957","date":"2026-10-08","epss":0.04035,"percentile":0.90344}],"urls":["https://bugs.launchpad.net/lxml/+bug/1888153","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20210521-0004/","https://www.debian.org/security/2021/dsa-4880","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28957","description":"An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14567","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14567","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14567","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14567","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"risk":2.15,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14567"},"relatedVulnerabilities":[{"id":"CVE-2018-14567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14567","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14567","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"urls":["http://www.securityfocus.com/bid/105198","https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://usn.ubuntu.com/3739-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14567","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14567","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14567","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14567","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"risk":2.15,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14567"},"relatedVulnerabilities":[{"id":"CVE-2018-14567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14567","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14567","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"urls":["http://www.securityfocus.com/bid/105198","https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://usn.ubuntu.com/3739-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3823","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3823","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3823","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3823","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3823","date":"2026-10-08","epss":0.04286,"percentile":0.90859}],"risk":2.1430000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3823"},"relatedVulnerabilities":[{"id":"CVE-2019-3823","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3823","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3823","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3823","date":"2026-10-08","epss":0.04286,"percentile":0.90859}],"urls":["http://www.securityfocus.com/bid/106950","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823","https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf","https://curl.haxx.se/docs/CVE-2019-3823.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.gentoo.org/glsa/201903-03","https://security.netapp.com/advisory/ntap-20190315-0001/","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3823","description":"libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller."}]},{"artifact":{"id":"94eee2f052d8b91f","cpes":["cpe:2.3:a:lxml:lxml:3.8.0:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@3.8.0","type":"python","version":"3.8.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pgww-xf46-h92r","versionConstraint":"<4.6.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"3.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pgww-xf46-h92r","fix":{"state":"fixed","versions":["4.6.2"],"available":[{"date":"2021-01-08","kind":"first-observed","version":"4.6.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-27783","date":"2026-10-08","epss":0.03982,"percentile":0.90227}],"risk":2.1303699999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-27783","https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7","https://bugzilla.redhat.com/show_bug.cgi?id=1901633","https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","https://snyk.io/vuln/SNYK-PYTHON-LXML-1047473","https://www.debian.org/security/2020/dsa-4810","https://advisory.checkmarx.net/advisory/CX-2020-4286","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2020-62.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK","https://pypi.org/project/lxml","https://security.netapp.com/advisory/ntap-20210521-0003","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pgww-xf46-h92r","description":"lxml vulnerable to Cross-site Scripting"},"relatedVulnerabilities":[{"id":"CVE-2020-27783","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-27783","cwe":"CWE-79","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-27783","date":"2026-10-08","epss":0.03982,"percentile":0.90227}],"urls":["https://advisory.checkmarx.net/advisory/CX-2020-4286","https://bugzilla.redhat.com/show_bug.cgi?id=1901633","https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/","https://security.netapp.com/advisory/ntap-20210521-0003/","https://www.debian.org/security/2020/dsa-4810","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-27783","description":"A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-16168","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16168","date":"2026-10-08","epss":0.04253,"percentile":0.90799}],"risk":2.1265,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16168"},"relatedVulnerabilities":[{"id":"CVE-2019-16168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16168","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16168","date":"2026-10-08","epss":0.04253,"percentile":0.90799}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/","https://security.gentoo.org/glsa/202003-16","https://security.netapp.com/advisory/ntap-20190926-0003/","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4205-1/","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62","https://www.sqlite.org/src/timeline?c=98357d8c1263920b","https://www.tenable.com/security/tns-2021-08","https://www.tenable.com/security/tns-2021-11","https://www.tenable.com/security/tns-2021-14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16168","description":"In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\""}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"risk":2.1153,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-08","epss":0.07051,"percentile":0.9404}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hj69-c76v-86wr","versionConstraint":"<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hj69-c76v-86wr","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5313","date":"2026-10-08","epss":0.02752,"percentile":0.85795}],"risk":2.09152,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5313","https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-84.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hj69-c76v-86wr","description":"Out-of-bounds Read in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5313","date":"2026-10-08","epss":0.02752,"percentile":0.85795}],"urls":["https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5313","description":"libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-14155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"risk":2.091,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-14155"},"relatedVulnerabilities":[{"id":"CVE-2020-14155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"urls":["http://seclists.org/fulldisclosure/2020/Dec/32","http://seclists.org/fulldisclosure/2021/Feb/14","https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/","https://bugs.gentoo.org/717920","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20221028-0010/","https://support.apple.com/kb/HT211931","https://support.apple.com/kb/HT212147","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.pcre.org/original/changelog.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14155","description":"libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring."}]},{"artifact":{"id":"dde7abf8df8072ec","cpes":["cpe:2.3:a:daniel_holth_project:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth_project:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth_project:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holthproject:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth_project:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholthproject:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:daniel_holth:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-wheel:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_wheel:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:wheel:python-wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:wheel:python_wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:dholth:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:wheel:0.29.0:*:*:*:*:*:*:*","cpe:2.3:a:wheel:wheel:0.29.0:*:*:*:*:*:*:*"],"name":"wheel","purl":"pkg:pypi/wheel@0.29.0","type":"python","version":"0.29.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/METADATA","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/RECORD","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/top_level.txt","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/wheel-0.29.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.38.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qwmp-2cf2-g9g6","versionConstraint":"<0.38.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"wheel","version":"0.29.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-qwmp-2cf2-g9g6","fix":{"state":"fixed","versions":["0.38.1"],"available":[{"date":"2022-12-27","kind":"first-observed","version":"0.38.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40898","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40898","date":"2026-10-08","epss":0.02735,"percentile":0.85678}],"risk":2.05125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40898","https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18","https://github.com/pypa/advisory-database/tree/main/vulns/wheel/PYSEC-2022-43017.yaml","https://pypi.org/project/wheel","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://pyup.io/vulnerabilities/CVE-2022-40898/51499"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qwmp-2cf2-g9g6","description":"pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2022-40898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40898","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40898","date":"2026-10-08","epss":0.02735,"percentile":0.85678}],"urls":["https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18","https://pypi.org/project/wheel/","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4051","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"risk":1.9997500000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4051"},"relatedVulnerabilities":[{"id":"CVE-2010-4051","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4051","date":"2026-10-08","epss":0.39995,"percentile":0.98598}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4051","description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\""}]},{"artifact":{"id":"6f015932bb925b0f","cpes":["cpe:2.3:a:login:login:1\\:4.2-3\\+deb8u4:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.2-3%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=shadow","type":"deb","version":"1:4.2-3+deb8u4","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/login.preinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12424","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"shadow","version":"1:4.2-3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12424","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"risk":1.9942499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12424"},"relatedVulnerabilities":[{"id":"CVE-2017-12424","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630","https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675","https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952","https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html","https://security.gentoo.org/glsa/201710-16"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12424","description":"In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts."}]},{"artifact":{"id":"d360b6f3245d4904","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.2-3\\+deb8u4:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/debian/passwd@1%3A4.2-3%2Bdeb8u4?arch=amd64&distro=debian-8.9&upstream=shadow","type":"deb","version":"1:4.2-3+deb8u4","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/passwd.preinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12424","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"shadow","version":"1:4.2-3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12424","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"risk":1.9942499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12424"},"relatedVulnerabilities":[{"id":"CVE-2017-12424","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12424","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12424","date":"2026-10-08","epss":0.02659,"percentile":0.85249}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630","https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675","https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952","https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html","https://security.gentoo.org/glsa/201710-16"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12424","description":"In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.16||>= 3.10.0a0, < 3.10.9||>= 3.11.0a0, < 3.11.1||>= 3.12.0a0, < 3.12.0a3||>= 3.8.0a0, < 3.8.16||>= 3.9.0a0, < 3.9.16 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.7.16"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.16||>= 3.10.0a0, < 3.10.9||>= 3.11.0a0, < 3.11.1||>= 3.12.0a0, < 3.12.0a3||>= 3.8.0a0, < 3.8.16||>= 3.9.0a0, < 3.9.16 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.16","3.8.16","3.9.16","3.10.9","3.11.1","3.12.0a3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.7.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.9"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.1"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.0a3"},{"date":"2026-09-22","kind":"first-observed","version":"3.8.16"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.1"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.0a3"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.16"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.16"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000100","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000100","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000100","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000100","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000100","date":"2026-10-08","epss":0.03958,"percentile":0.90165}],"risk":1.9789999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000100"},"relatedVulnerabilities":[{"id":"CVE-2017-1000100","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000100","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000100","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000100","date":"2026-10-08","epss":0.03958,"percentile":0.90165}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/100286","http://www.securitytracker.com/id/1039118","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20170809B.html","https://security.gentoo.org/glsa/201709-14","https://support.apple.com/HT208221"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000100","description":"When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rwv7-3v45-hg29","versionConstraint":">=2.4.0,<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-rwv7-3v45-hg29","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25288","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25288","date":"2026-10-08","epss":0.02388,"percentile":0.83436}],"risk":1.96413,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25288","https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33","https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rwv7-3v45-hg29","description":"Pillow Out-of-bounds Read vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2021-25288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25288","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25288","date":"2026-10-08","epss":0.02388,"percentile":0.83436}],"urls":["https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","https://security.gentoo.org/glsa/202107-33"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25288","description":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2009-5155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2009-5155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"risk":1.9529999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2009-5155"},"relatedVulnerabilities":[{"id":"CVE-2009-5155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2009-5155","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2009-5155","date":"2026-10-08","epss":0.03906,"percentile":0.90012}],"urls":["http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=11053","https://sourceware.org/bugzilla/show_bug.cgi?id=18986","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672","https://support.f5.com/csp/article/K64119434","https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2009-5155","description":"In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."}]},{"artifact":{"id":"bfdd60b7863be70b","cpes":["cpe:2.3:a:python:setuptools:36.4.0:*:*:*:*:*:*:*"],"name":"setuptools","purl":"pkg:pypi/setuptools@36.4.0","type":"python","version":"36.4.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/METADATA","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/RECORD","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/top_level.txt","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"65.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r9hx-vwmv-q579","versionConstraint":"<65.5.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"setuptools","version":"36.4.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-r9hx-vwmv-q579","fix":{"state":"fixed","versions":["65.5.1"],"available":[{"date":"2022-12-28","kind":"first-observed","version":"65.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40897","date":"2026-10-08","epss":0.02503,"percentile":0.84248}],"risk":1.95234,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40897","https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://github.com/pypa/setuptools/issues/3659","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://pyup.io/vulnerabilities/CVE-2022-40897/52495","https://security.netapp.com/advisory/ntap-20230214-0001","https://security.netapp.com/advisory/ntap-20240621-0006","https://setuptools.pypa.io/en/latest","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r9hx-vwmv-q579","description":"pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2022-40897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40897","cwe":"CWE-1333","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40897","date":"2026-10-08","epss":0.02503,"percentile":0.84248}],"urls":["https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","https://pyup.io/vulnerabilities/CVE-2022-40897/52495/","https://security.netapp.com/advisory/ntap-20230214-0001/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40897","description":"Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r7m-5h27-29hp","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-7r7m-5h27-29hp","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28676","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28676","date":"2026-10-08","epss":0.02501,"percentile":0.84228}],"risk":1.9507800000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28676","https://github.com/python-pillow/Pillow/pull/5377","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r7m-5h27-29hp","description":"Potential infinite loop in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-28676","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28676","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28676","date":"2026-10-08","epss":0.02501,"percentile":0.84228}],"urls":["https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856","https://github.com/python-pillow/Pillow/pull/5377","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28676","description":"An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13728","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13728","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"risk":1.9480000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13728"},"relatedVulnerabilities":[{"id":"CVE-2017-13728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484274","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13728","description":"There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13728","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13728","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"risk":1.9480000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13728"},"relatedVulnerabilities":[{"id":"CVE-2017-13728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484274","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13728","description":"There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13728","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13728","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"risk":1.9480000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13728"},"relatedVulnerabilities":[{"id":"CVE-2017-13728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484274","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13728","description":"There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13728","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13728","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"risk":1.9480000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13728"},"relatedVulnerabilities":[{"id":"CVE-2017-13728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484274","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13728","description":"There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13728","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13728","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"risk":1.9480000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13728"},"relatedVulnerabilities":[{"id":"CVE-2017-13728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13728","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13728","date":"2026-10-08","epss":0.03896,"percentile":0.89985}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484274","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13728","description":"There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack."}]},{"artifact":{"id":"b68275c56711777c","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u5:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=curl","type":"deb","version":"7.38.0-4+deb8u5","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000101","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"curl","version":"7.38.0-4+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000101","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000101","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000101","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000101","date":"2026-10-08","epss":0.03875,"percentile":0.89939}],"risk":1.9375,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000101"},"relatedVulnerabilities":[{"id":"CVE-2017-1000101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000101","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000101","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000101","date":"2026-10-08","epss":0.03875,"percentile":0.89939}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/100249","http://www.securitytracker.com/id/1039117","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20170809A.html","https://security.gentoo.org/glsa/201709-14","https://support.apple.com/HT208221"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000101","description":"curl supports \"globbing\" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-11008","versionConstraint":"< 1:2.1.4-2.1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11008","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"risk":1.9335000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11008"},"relatedVulnerabilities":[{"id":"CVE-2020-11008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://seclists.org/fulldisclosure/2020/May/41","https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211183","https://usn.ubuntu.com/4334-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11008","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a \"blank\" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's \"store\" helper - Git's \"cache\" helper - the \"osxkeychain\" helper that ships in Git's \"contrib\" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11008","versionConstraint":"< 1:2.1.4-2.1+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-11008","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"risk":1.9335000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11008"},"relatedVulnerabilities":[{"id":"CVE-2020-11008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11008","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11008","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11008","date":"2026-10-08","epss":0.03867,"percentile":0.89918}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://seclists.org/fulldisclosure/2020/May/41","https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282","https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211183","https://usn.ubuntu.com/4334-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11008","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a \"blank\" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's \"store\" helper - Git's \"cache\" helper - the \"osxkeychain\" helper that ships in Git's \"contrib\" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability."}]},{"artifact":{"id":"c483cb81e196eb6c","cpes":["cpe:2.3:a:libssl-dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl-dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl_dev:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl-dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl_dev:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl-dev","purl":"pkg:deb/debian/libssl-dev@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssl-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssl-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"38b08aeceab1c386","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"825516cb672b6c51","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u6?arch=amd64&distro=debian-8.9","type":"deb","version":"1.0.1t-1+deb8u6","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1563","versionConstraint":"< 1.0.1t-1+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1563","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"risk":1.9189999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1563"},"relatedVulnerabilities":[{"id":"CVE-2019-1563","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1563","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-1563","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1563","date":"2026-10-08","epss":0.03838,"percentile":0.89841}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","https://seclists.org/bugtraq/2019/Oct/0","https://seclists.org/bugtraq/2019/Oct/1","https://seclists.org/bugtraq/2019/Sep/25","https://security.gentoo.org/glsa/201911-04","https://security.netapp.com/advisory/ntap-20190919-0002/","https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4376-2/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4539","https://www.debian.org/security/2019/dsa-4540","https://www.openssl.org/news/secadv/20190910.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-09"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","description":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s)."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-6969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-6969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-6969","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6969","date":"2026-10-08","epss":0.03794,"percentile":0.89711}],"risk":1.897,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-6969"},"relatedVulnerabilities":[{"id":"CVE-2017-6969","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6969","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6969","date":"2026-10-08","epss":0.03794,"percentile":0.89711}],"urls":["http://www.securityfocus.com/bid/97065","https://security.gentoo.org/glsa/201709-02","https://sourceware.org/bugzilla/show_bug.cgi?id=21156"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6969","description":"readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17498","versionConstraint":"< 1.4.3-4.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17498","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"risk":1.881,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17498"},"relatedVulnerabilities":[{"id":"CVE-2019-17498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html","http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/","https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498","https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480","https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c","https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/","https://security.netapp.com/advisory/ntap-20220909-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17498","description":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server."}]},{"artifact":{"id":"73ce11e421387be2","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"7c1b991b47a08222","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/debian/libc-dev-bin@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"75d9e7a7cb1f0774","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"faba8426e6ea1760","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/debian/libc6-dev@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"7dd902ced56e16a8","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u10:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u10:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u10?arch=amd64&distro=debian-8.9&upstream=glibc","type":"deb","version":"2.19-18+deb8u10","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"glibc","version":"2.19-18+deb8u10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"risk":1.8657,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5180"},"relatedVulnerabilities":[{"id":"CVE-2015-5180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5180","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5180","date":"2026-10-08","epss":0.06219,"percentile":0.93356}],"urls":["http://www.securityfocus.com/bid/99324","http://www.ubuntu.com/usn/USN-3239-1","http://www.ubuntu.com/usn/USN-3239-2","https://access.redhat.com/errata/RHSA-2018:0805","https://bugzilla.redhat.com/show_bug.cgi?id=1249603","https://security.gentoo.org/glsa/201706-19","https://sourceware.org/bugzilla/attachment.cgi?id=8492","https://sourceware.org/bugzilla/show_bug.cgi?id=18784","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5","https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5180","description":"res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash)."}]},{"artifact":{"id":"e6018bed8eee8681","cpes":["cpe:2.3:a:libpq-dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq-dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq_dev:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq-dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libpq:libpq_dev:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq-dev","purl":"pkg:deb/debian/libpq-dev@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq-dev.list"}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.15-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15098","versionConstraint":"< 9.4.15-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15098","fix":{"state":"fixed","versions":["9.4.15-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.15-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15098","date":"2026-10-08","epss":0.03723,"percentile":0.89511}],"risk":1.8615,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4027-1","link":"https://security-tracker.debian.org/tracker/DSA-4027-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15098"},"relatedVulnerabilities":[{"id":"CVE-2017-15098","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","metrics":{"baseScore":5.5,"impactScore":5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15098","date":"2026-10-08","epss":0.03723,"percentile":0.89511}],"urls":["http://www.securityfocus.com/bid/101781","http://www.securitytracker.com/id/1039752","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://www.debian.org/security/2017/dsa-4027","https://www.debian.org/security/2017/dsa-4028","https://www.postgresql.org/about/news/1801/","https://www.postgresql.org/support/security/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory."}]},{"artifact":{"id":"129495beb6b7ad25","cpes":["cpe:2.3:a:libpq5:libpq5:9.4.13-0\\+deb8u1:*:*:*:*:*:*:*"],"name":"libpq5","purl":"pkg:deb/debian/libpq5@9.4.13-0%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=postgresql-9.4","type":"deb","version":"9.4.13-0+deb8u1","language":"","licenses":["Tcl","almost"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpq5/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libpq5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpq5:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libpq5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"postgresql-9.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.4.15-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15098","versionConstraint":"< 9.4.15-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"postgresql-9.4","version":"9.4.13-0+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15098","fix":{"state":"fixed","versions":["9.4.15-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"9.4.15-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15098","date":"2026-10-08","epss":0.03723,"percentile":0.89511}],"risk":1.8615,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4027-1","link":"https://security-tracker.debian.org/tracker/DSA-4027-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15098"},"relatedVulnerabilities":[{"id":"CVE-2017-15098","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","metrics":{"baseScore":5.5,"impactScore":5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15098","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15098","date":"2026-10-08","epss":0.03723,"percentile":0.89511}],"urls":["http://www.securityfocus.com/bid/101781","http://www.securitytracker.com/id/1039752","https://access.redhat.com/errata/RHSA-2018:2511","https://access.redhat.com/errata/RHSA-2018:2566","https://www.debian.org/security/2017/dsa-4027","https://www.debian.org/security/2017/dsa-4028","https://www.postgresql.org/about/news/1801/","https://www.postgresql.org/support/security/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15098","description":"Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8xjq-8fcg-g5hw","versionConstraint":">=0,<8.1.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8xjq-8fcg-g5hw","fix":{"state":"fixed","versions":["8.1.1"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"8.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25290","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25290","date":"2026-10-08","epss":0.02372,"percentile":0.83329}],"risk":1.8501600000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-25290","https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-36.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw","description":"Out-of-bounds Write in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-25290","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25290","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25290","date":"2026-10-08","epss":0.02372,"percentile":0.83329}],"urls":["https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25290","description":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14404","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14404","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-14404","date":"2026-10-08","epss":0.0365,"percentile":0.89299}],"risk":1.825,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14404"},"relatedVulnerabilities":[{"id":"CVE-2018-14404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-14404","date":"2026-10-08","epss":0.0365,"percentile":0.89299}],"urls":["https://access.redhat.com/errata/RHSA-2019:1543","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817","https://bugzilla.redhat.com/show_bug.cgi?id=1595985","https://gitlab.gnome.org/GNOME/libxml2/issues/10","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://security.netapp.com/advisory/ntap-20190719-0002/","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14404","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14404","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-14404","date":"2026-10-08","epss":0.0365,"percentile":0.89299}],"risk":1.825,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14404"},"relatedVulnerabilities":[{"id":"CVE-2018-14404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-14404","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-14404","date":"2026-10-08","epss":0.0365,"percentile":0.89299}],"urls":["https://access.redhat.com/errata/RHSA-2019:1543","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817","https://bugzilla.redhat.com/show_bug.cgi?id=1595985","https://gitlab.gnome.org/GNOME/libxml2/issues/10","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://security.netapp.com/advisory/ntap-20190719-0002/","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5hq-fp76-qmrc","versionConstraint":"<8.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-q5hq-fp76-qmrc","fix":{"state":"fixed","versions":["8.2.0"],"available":[{"date":"2021-06-09","kind":"first-observed","version":"8.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28677","date":"2026-10-08","epss":0.02338,"percentile":0.83082}],"risk":1.8236400000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28677","https://github.com/python-pillow/Pillow/pull/5377","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","https://security.gentoo.org/glsa/202107-33","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc","description":"Uncontrolled Resource Consumption in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2021-28677","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28677","date":"2026-10-08","epss":0.02338,"percentile":0.83082}],"urls":["https://github.com/python-pillow/Pillow/pull/5377","https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","https://security.gentoo.org/glsa/202107-33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28677","description":"An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening."}]},{"artifact":{"id":"2ca46dc98110edb6","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u7","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.30-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10844","versionConstraint":"< 3.3.30-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10844","fix":{"state":"fixed","versions":["3.3.30-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.30-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-10844","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10844","cwe":"CWE-327","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10844","date":"2026-10-08","epss":0.03623,"percentile":0.89215}],"risk":1.8114999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10844"},"relatedVulnerabilities":[{"id":"CVE-2018-10844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10844","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10844","cwe":"CWE-327","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10844","date":"2026-10-08","epss":0.03623,"percentile":0.89215}],"urls":["http://www.securityfocus.com/bid/105138","https://access.redhat.com/errata/RHSA-2018:3050","https://access.redhat.com/errata/RHSA-2018:3505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844","https://eprint.iacr.org/2018/747","https://gitlab.com/gnutls/gnutls/merge_requests/657","https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/","https://usn.ubuntu.com/3999-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10844","description":"It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets."}]},{"artifact":{"id":"2ca46dc98110edb6","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u7:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u7","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.30-0+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10845","versionConstraint":"< 3.3.30-0+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10845","fix":{"state":"fixed","versions":["3.3.30-0+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.30-0+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-10845","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10845","cwe":"CWE-327","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10845","date":"2026-10-08","epss":0.03623,"percentile":0.89215}],"risk":1.8114999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10845"},"relatedVulnerabilities":[{"id":"CVE-2018-10845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10845","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-10845","cwe":"CWE-327","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10845","date":"2026-10-08","epss":0.03623,"percentile":0.89215}],"urls":["http://www.securityfocus.com/bid/105138","https://access.redhat.com/errata/RHSA-2018:3050","https://access.redhat.com/errata/RHSA-2018:3505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845","https://eprint.iacr.org/2018/747","https://gitlab.com/gnutls/gnutls/merge_requests/657","https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/","https://usn.ubuntu.com/3999-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10845","description":"It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets."}]},{"artifact":{"id":"68af2b014b1e7a5d","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1c4694f66f95200803200fe9478ac7d9fd9a8a15fb6efdc7b42f2b52d0e30520","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20218","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20218","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20218","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20218","date":"2026-10-08","epss":0.03622,"percentile":0.89215}],"risk":1.8110000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20218"},"relatedVulnerabilities":[{"id":"CVE-2019-20218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20218","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20218","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20218","date":"2026-10-08","epss":0.03622,"percentile":0.89215}],"urls":["https://github.com/sqlite/sqlite/commit/a6c1a71cde082e09750465d5675699062922e387","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00016.html","https://security.gentoo.org/glsa/202007-26","https://usn.ubuntu.com/4298-1/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20218","description":"selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-20852","versionConstraint":">= 2.0, <= 2.7.16||>= 3.0.0, < 3.4.10||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.9||>= 3.7.0, < 3.7.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-20852","fix":{"state":"fixed","versions":["3.4.10","3.5.7","3.6.9","3.7.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.4.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.5.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.9"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20852","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20852","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20852","date":"2026-10-08","epss":0.03668,"percentile":0.89348}],"risk":1.8095466666666666,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue35121","https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://python-security.readthedocs.io/vuln/cookie-domain-check.html","https://security.gentoo.org/glsa/202003-26","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20852","description":"http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.10"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-18348","versionConstraint":">= 2.0, <= 2.7.17||>= 3.0, < 3.5.10||>= 3.6.0, < 3.6.11||>= 3.7.0, < 3.7.8||>= 3.8.0, < 3.8.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-18348","fix":{"state":"fixed","versions":["3.5.10","3.6.11","3.7.8","3.8.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.5.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.6.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.8"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18348","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-18348","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-18348","date":"2026-10-08","epss":0.03513,"percentile":0.88887}],"risk":1.8033400000000002,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html","https://bugs.python.org/issue30458#msg347282","https://bugzilla.redhat.com/show_bug.cgi?id=1727276","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://security.netapp.com/advisory/ntap-20191107-0004/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18348","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1."},"relatedVulnerabilities":[]},{"artifact":{"id":"eb3307d2038e01a5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.0.3","type":"python","version":"2.0.3","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hggm-jpg3-v476","versionConstraint":"<3.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.0.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hggm-jpg3-v476","fix":{"state":"fixed","versions":["3.2"],"available":[{"date":"2020-10-28","kind":"first-observed","version":"3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25659","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25659","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25659","date":"2026-10-08","epss":0.02463,"percentile":0.8398}],"risk":1.7918325,"urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-hggm-jpg3-v476","https://github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494","https://nvd.nist.gov/vuln/detail/CVE-2020-25659","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/pyca/cryptography/pull/5507","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2021-62.yaml","https://pypi.org/project/cryptography"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hggm-jpg3-v476","description":"RSA decryption vulnerable to Bleichenbacher timing vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2020-25659","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25659","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-25659","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25659","date":"2026-10-08","epss":0.02463,"percentile":0.8398}],"urls":["https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25659","description":"python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vcqg-3p29-xw73","versionConstraint":">=0,<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vcqg-3p29-xw73","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2021-11-04","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5310","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5310","date":"2026-10-08","epss":0.01975,"percentile":0.79844}],"risk":1.7824375000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-5310","https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vcqg-3p29-xw73","description":"Integer overflow in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2020-5310","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5310","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5310","date":"2026-10-08","epss":0.01975,"percentile":0.79844}],"urls":["https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310","description":"libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14939","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14939","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-14939","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14939","date":"2026-10-08","epss":0.05941,"percentile":0.93084}],"risk":1.7822999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14939"},"relatedVulnerabilities":[{"id":"CVE-2017-14939","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14939","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14939","date":"2026-10-08","epss":0.05941,"percentile":0.93084}],"urls":["http://www.securityfocus.com/bid/101216","https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read_1_byte-dwarf2-c/","https://sourceware.org/bugzilla/show_bug.cgi?id=22169","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=515f23e63c0074ab531bc954f84ca40c6281a724","https://www.exploit-db.com/exploits/42970/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14939","description":"decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7592","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-10-08","epss":0.02303,"percentile":0.82804}],"risk":1.72725,"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.9&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3863","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3863","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3863","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3863","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3863","date":"2026-10-08","epss":0.03437,"percentile":0.88638}],"risk":1.7185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3863"},"relatedVulnerabilities":[{"id":"CVE-2019-3863","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3863","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3863","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3863","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3863","date":"2026-10-08","epss":0.03437,"percentile":0.88638}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3863.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3863","description":"A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2014-9939","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9939","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9939","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9939","date":"2026-10-08","epss":0.02284,"percentile":0.82634}],"risk":1.7129999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9939"},"relatedVulnerabilities":[{"id":"CVE-2014-9939","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9939","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9939","date":"2026-10-08","epss":0.02284,"percentile":0.82634}],"urls":["http://www.openwall.com/lists/oss-security/2015/07/31/6","https://sourceware.org/bugzilla/show_bug.cgi?id=18750","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7e27a9d5f22f9f7ead11738b1546d0b5c737266b"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9939","description":"ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects."}]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1152","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1152","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"risk":1.7005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1152"},"relatedVulnerabilities":[{"id":"CVE-2018-1152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","http://www.securityfocus.com/bid/104543","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.tenable.com/security/research/tra-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1152","description":"libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1152","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1152","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"risk":1.7005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1152"},"relatedVulnerabilities":[{"id":"CVE-2018-1152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","http://www.securityfocus.com/bid/104543","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.tenable.com/security/research/tra-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1152","description":"libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1152","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1152","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"risk":1.7005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1152"},"relatedVulnerabilities":[{"id":"CVE-2018-1152","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1152","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1152","date":"2026-10-08","epss":0.03401,"percentile":0.88524}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","http://www.securityfocus.com/bid/104543","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/","https://www.tenable.com/security/research/tra-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1152","description":"libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image."}]},{"artifact":{"id":"e0c6a93aa7e9617e","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15686","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15686","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"risk":1.69575,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15686"},"relatedVulnerabilities":[{"id":"CVE-2018-15686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"urls":["http://www.securityfocus.com/bid/105747","https://access.redhat.com/errata/RHSA-2019:2091","https://access.redhat.com/errata/RHSA-2019:3222","https://access.redhat.com/errata/RHSA-2020:0593","https://github.com/systemd/systemd/pull/10519","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3816-1/","https://www.exploit-db.com/exploits/45714/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15686","description":"A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239."}]},{"artifact":{"id":"2b62d95a9e611fdf","cpes":["cpe:2.3:a:libudev1:libudev1:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15686","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15686","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"risk":1.69575,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15686"},"relatedVulnerabilities":[{"id":"CVE-2018-15686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"urls":["http://www.securityfocus.com/bid/105747","https://access.redhat.com/errata/RHSA-2019:2091","https://access.redhat.com/errata/RHSA-2019:3222","https://access.redhat.com/errata/RHSA-2020:0593","https://github.com/systemd/systemd/pull/10519","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3816-1/","https://www.exploit-db.com/exploits/45714/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15686","description":"A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239."}]},{"artifact":{"id":"e450ef05193f69e3","cpes":["cpe:2.3:a:systemd:systemd:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/debian/systemd@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.list"},{"path":"/var/lib/dpkg/info/systemd.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postinst"},{"path":"/var/lib/dpkg/info/systemd.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postrm"},{"path":"/var/lib/dpkg/info/systemd.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.preinst"},{"path":"/var/lib/dpkg/info/systemd.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.prerm"},{"path":"/var/lib/dpkg/info/systemd.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-15686","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15686","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"risk":1.69575,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15686"},"relatedVulnerabilities":[{"id":"CVE-2018-15686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"urls":["http://www.securityfocus.com/bid/105747","https://access.redhat.com/errata/RHSA-2019:2091","https://access.redhat.com/errata/RHSA-2019:3222","https://access.redhat.com/errata/RHSA-2020:0593","https://github.com/systemd/systemd/pull/10519","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3816-1/","https://www.exploit-db.com/exploits/45714/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15686","description":"A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239."}]},{"artifact":{"id":"59a35c804cdace6f","cpes":["cpe:2.3:a:systemd-sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd-sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd-sysv","purl":"pkg:deb/debian/systemd-sysv@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd-sysv/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd-sysv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.list"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15686","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15686","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"risk":1.69575,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15686"},"relatedVulnerabilities":[{"id":"CVE-2018-15686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"urls":["http://www.securityfocus.com/bid/105747","https://access.redhat.com/errata/RHSA-2019:2091","https://access.redhat.com/errata/RHSA-2019:3222","https://access.redhat.com/errata/RHSA-2020:0593","https://github.com/systemd/systemd/pull/10519","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3816-1/","https://www.exploit-db.com/exploits/45714/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15686","description":"A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239."}]},{"artifact":{"id":"29e72562c3e4b088","cpes":["cpe:2.3:a:udev:udev:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/debian/udev@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.prerm"},{"path":"/var/lib/dpkg/info/udev.templates","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.templates"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15686","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15686","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"risk":1.69575,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15686"},"relatedVulnerabilities":[{"id":"CVE-2018-15686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15686","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15686","date":"2026-10-08","epss":0.02261,"percentile":0.82449}],"urls":["http://www.securityfocus.com/bid/105747","https://access.redhat.com/errata/RHSA-2019:2091","https://access.redhat.com/errata/RHSA-2019:3222","https://access.redhat.com/errata/RHSA-2020:0593","https://github.com/systemd/systemd/pull/10519","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3816-1/","https://www.exploit-db.com/exploits/45714/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15686","description":"A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1353","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1353","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"risk":1.683,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1353"},"relatedVulnerabilities":[{"id":"CVE-2019-1353","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1353","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1353","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1353","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"risk":1.683,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1353"},"relatedVulnerabilities":[{"id":"CVE-2019-1353","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1353","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1353","date":"2026-10-08","epss":0.02244,"percentile":0.8233}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1353","description":"An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active."}]},{"artifact":{"id":"eb3307d2038e01a5","cpes":["cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:2.0.3:*:*:*:*:*:*:*"],"name":"cryptography","purl":"pkg:pypi/cryptography@2.0.3","type":"python","version":"2.0.3","language":"python","licenses":["BSD or Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/cryptography-2.0.3.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"42.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9v9h-cgj8-h64p","versionConstraint":"<42.0.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"cryptography","version":"2.0.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-9v9h-cgj8-h64p","fix":{"state":"fixed","versions":["42.0.2"],"available":[{"date":"2024-02-17","kind":"first-observed","version":"42.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-0727","https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","https://github.com/github/advisory-database/pull/3472","https://github.com/openssl/openssl/pull/23362","https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2","https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d","https://security.netapp.com/advisory/ntap-20240208-0006","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9v9h-cgj8-h64p","description":"Null pointer dereference in PKCS12 parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-6232","versionConstraint":"< 3.8.20||>= 3.10.0, < 3.10.15||>= 3.11.0, < 3.11.10||>= 3.12.0, < 3.12.6||>= 3.13.0a1, < 3.13.0rc2||>= 3.9.0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-6232","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0rc2"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0rc2"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0rc2"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-6232","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6232","date":"2026-10-08","epss":0.02203,"percentile":0.81998}],"risk":1.6522500000000002,"urls":["https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4","https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06","https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4","https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d","https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877","https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf","https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373","https://github.com/python/cpython/issues/121285","https://github.com/python/cpython/pull/121286","https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/","http://www.openwall.com/lists/oss-security/2024/09/03/5","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0007/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6232","description":"There is a MEDIUM severity vulnerability affecting CPython.\n\n\n\n\n\nRegular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gm3-px64-rw72","versionConstraint":">=0,<6.2.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-5gm3-px64-rw72","fix":{"state":"fixed","versions":["6.2.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"6.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19911","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19911","date":"2026-10-08","epss":0.02118,"percentile":0.81276}],"risk":1.6520400000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-19911","https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d","https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://www.debian.org/security/2020/dsa-4631","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","https://usn.ubuntu.com/4272-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gm3-px64-rw72","description":"Uncontrolled Resource Consumption in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2019-19911","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19911","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19911","date":"2026-10-08","epss":0.02118,"percentile":0.81276}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","https://usn.ubuntu.com/4272-1/","https://www.debian.org/security/2020/dsa-4631"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19911","description":"There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer."}]},{"artifact":{"id":"201c7c9f2573b717","cpes":["cpe:2.3:a:python:requests:2.12.5:*:*:*:*:*:*:*"],"name":"requests","purl":"pkg:pypi/requests@2.12.5","type":"python","version":"2.12.5","language":"python","licenses":["Apache 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/requests-2.12.5.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j8r2-6x86-q33q","versionConstraint":">=2.3.0,<2.31.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"requests","version":"2.12.5"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-j8r2-6x86-q33q","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2023-05-23","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32681","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-32681","date":"2026-10-08","epss":0.02974,"percentile":0.86852}],"risk":1.6505699999999999,"urls":["https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5","https://nvd.nist.gov/vuln/detail/CVE-2023-32681","https://github.com/psf/requests/releases/tag/v2.31.0","https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml","https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html","https://security.gentoo.org/glsa/202309-08","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j8r2-6x86-q33q","description":"Unintended leak of Proxy-Authorization header in requests"},"relatedVulnerabilities":[{"id":"CVE-2023-32681","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32681","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-32681","date":"2026-10-08","epss":0.02974,"percentile":0.86852}],"urls":["https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5","https://github.com/psf/requests/releases/tag/v2.31.0","https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/","https://security.gentoo.org/glsa/202309-08"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681","description":"Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12799","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12799","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12799","date":"2026-10-08","epss":0.03298,"percentile":0.88173}],"risk":1.649,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12799"},"relatedVulnerabilities":[{"id":"CVE-2017-12799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12799","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12799","date":"2026-10-08","epss":0.03298,"percentile":0.88173}],"urls":["http://www.securityfocus.com/bid/100292","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21933"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12799","description":"The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file."}]},{"artifact":{"id":"e9bcfc704cee792c","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"8f4ff33619882fd1","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"a1c91ab754578fc9","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"d12534a6470be934","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"dd7de04c6f6544ab","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-11462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"risk":1.6442999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-11462"},"relatedVulnerabilities":[{"id":"CVE-2017-11462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11462","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11462","date":"2026-10-08","epss":0.05481,"percentile":0.92559}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","https://bugzilla.redhat.com/show_bug.cgi?id=1488873","https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-10373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-10373","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10373","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10373","date":"2026-10-08","epss":0.03282,"percentile":0.88103}],"risk":1.641,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10373"},"relatedVulnerabilities":[{"id":"CVE-2018-10373","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10373","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10373","date":"2026-10-08","epss":0.03282,"percentile":0.88103}],"urls":["http://www.securityfocus.com/bid/104000","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3032","https://security.gentoo.org/glsa/201908-01","https://sourceware.org/bugzilla/show_bug.cgi?id=23065","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10373","description":"concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new."}]},{"artifact":{"id":"94eee2f052d8b91f","cpes":["cpe:2.3:a:lxml:lxml:3.8.0:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@3.8.0","type":"python","version":"3.8.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-55x5-fj6c-h6m8","versionConstraint":"<4.6.5 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"3.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-55x5-fj6c-h6m8","fix":{"state":"fixed","versions":["4.6.5"],"available":[{"date":"2021-12-14","kind":"first-observed","version":"4.6.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43818","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43818","date":"2026-10-08","epss":0.02663,"percentile":0.85272}],"risk":1.6310875000000002,"urls":["https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8","https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776","https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0","https://nvd.nist.gov/vuln/detail/CVE-2021-43818","https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html","https://www.debian.org/security/2022/dsa-5043","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202208-06","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44","https://security.netapp.com/advisory/ntap-20220107-0005"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-55x5-fj6c-h6m8","description":"lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through"},"relatedVulnerabilities":[{"id":"CVE-2021-43818","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"impactScore":3.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43818","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-43818","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43818","date":"2026-10-08","epss":0.02663,"percentile":0.85272}],"urls":["https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776","https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0","https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8","https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20220107-0005/","https://www.debian.org/security/2022/dsa-5043","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818","description":"lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available."}]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-13790","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"risk":1.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13790"},"relatedVulnerabilities":[{"id":"CVE-2020-13790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13790","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13790","date":"2026-10-08","epss":0.03205,"percentile":0.87777}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","https://security.gentoo.org/glsa/202010-03","https://usn.ubuntu.com/4386-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file."}]},{"artifact":{"id":"8d57403d1363ac3e","cpes":["cpe:2.3:a:unbit_project:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit_project:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info_project:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python-uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python_uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbitproject:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:python-uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:python_uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:infoproject:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:python:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:unbit:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:uwsgi:uwsgi:2.0.15:*:*:*:*:*:*:*","cpe:2.3:a:info:uwsgi:2.0.15:*:*:*:*:*:*:*"],"name":"uwsgi","purl":"pkg:pypi/uwsgi@2.0.15","type":"python","version":"2.0.15","language":"python","licenses":["GPL2"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/uWSGI-2.0.15-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vcph-37mh-fqrh","versionConstraint":"<2.0.22 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"uwsgi","version":"2.0.15"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vcph-37mh-fqrh","fix":{"state":"fixed","versions":["2.0.22"],"available":[{"date":"2023-08-25","kind":"first-observed","version":"2.0.22"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27522","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-27522","date":"2026-10-08","epss":0.02134,"percentile":0.81431}],"risk":1.6005000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-27522","https://httpd.apache.org/security/vulnerabilities_24.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html","https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d","https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822","https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569","https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html","https://security.gentoo.org/glsa/202309-01"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vcph-37mh-fqrh","description":"Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling"},"relatedVulnerabilities":[{"id":"CVE-2023-27522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27522","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-27522","date":"2026-10-08","epss":0.02134,"percentile":0.81431}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html","https://security.gentoo.org/glsa/202309-01","https://github.com/advisories/GHSA-vcph-37mh-fqrh"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27522","description":"HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.\n\nSpecial characters in the origin response header can truncate/split the response forwarded to the client."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-20388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"risk":1.5725,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20388"},"relatedVulnerabilities":[{"id":"CVE-2019-20388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20388","description":"xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-20388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"risk":1.5725,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20388"},"relatedVulnerabilities":[{"id":"CVE-2019-20388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20388","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20388","date":"2026-10-08","epss":0.03145,"percentile":0.87542}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20388","description":"xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12967","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12967","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12967","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12967","date":"2026-10-08","epss":0.03101,"percentile":0.87368}],"risk":1.5505,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12967"},"relatedVulnerabilities":[{"id":"CVE-2017-12967","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12967","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12967","date":"2026-10-08","epss":0.03101,"percentile":0.87368}],"urls":["http://www.securityfocus.com/bid/100462","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=21962"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12967","description":"The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary."}]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14498","versionConstraint":"< 1:1.3.1-12+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14498","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"risk":1.546,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14498"},"relatedVulnerabilities":[{"id":"CVE-2018-14498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","https://access.redhat.com/errata/RHSA-2019:2052","https://access.redhat.com/errata/RHSA-2019:3705","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258","https://github.com/mozilla/mozjpeg/issues/299","https://lists.debian.org/debian-lts-announce/2019/03/msg00021.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/","https://usn.ubuntu.com/4190-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14498","versionConstraint":"< 1:1.3.1-12+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14498","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"risk":1.546,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14498"},"relatedVulnerabilities":[{"id":"CVE-2018-14498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","https://access.redhat.com/errata/RHSA-2019:2052","https://access.redhat.com/errata/RHSA-2019:3705","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258","https://github.com/mozilla/mozjpeg/issues/299","https://lists.debian.org/debian-lts-announce/2019/03/msg00021.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/","https://usn.ubuntu.com/4190-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14498","versionConstraint":"< 1:1.3.1-12+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14498","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"risk":1.546,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14498"},"relatedVulnerabilities":[{"id":"CVE-2018-14498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14498","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14498","date":"2026-10-08","epss":0.03092,"percentile":0.87342}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","https://access.redhat.com/errata/RHSA-2019:2052","https://access.redhat.com/errata/RHSA-2019:3705","https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55","https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258","https://github.com/mozilla/mozjpeg/issues/299","https://lists.debian.org/debian-lts-announce/2019/03/msg00021.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/","https://usn.ubuntu.com/4190-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries."}]},{"artifact":{"id":"bfdd60b7863be70b","cpes":["cpe:2.3:a:python:setuptools:36.4.0:*:*:*:*:*:*:*"],"name":"setuptools","purl":"pkg:pypi/setuptools@36.4.0","type":"python","version":"36.4.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/METADATA","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/RECORD","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/top_level.txt","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/setuptools-36.4.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"70.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cx63-2mw6-8hw5","versionConstraint":"<70.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"setuptools","version":"36.4.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-cx63-2mw6-8hw5","fix":{"state":"fixed","versions":["70.0.0"],"available":[{"date":"2024-07-16","kind":"first-observed","version":"70.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-10-08","epss":0.01939,"percentile":0.79511}],"risk":1.5172675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-6345","https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://github.com/pypa/setuptools/pull/4332","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cx63-2mw6-8hw5","description":"setuptools vulnerable to Command Injection via package URL"},"relatedVulnerabilities":[{"id":"CVE-2024-6345","cvss":[{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6345","cwe":"CWE-94","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2024-6345","date":"2026-10-08","epss":0.01939,"percentile":0.79511}],"urls":["https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0","https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html","https://github.com/advisories/GHSA-cx63-2mw6-8hw5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345","description":"A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pw3c-h7wp-cvhx","versionConstraint":"<9.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-pw3c-h7wp-cvhx","fix":{"state":"fixed","versions":["9.0.0"],"available":[{"date":"2022-01-13","kind":"first-observed","version":"9.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22815","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22815","date":"2026-10-08","epss":0.02578,"percentile":0.84743}],"risk":1.50813,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22815","https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://www.debian.org/security/2022/dsa-5053","https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c","https://github.com/python-pillow/Pillow/pull/5920","https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c","https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx","description":"Improper Initialization in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2022-22815","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22815","cwe":"CWE-665","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22815","date":"2026-10-08","epss":0.02578,"percentile":0.84743}],"urls":["https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","https://security.gentoo.org/glsa/202211-10","https://www.debian.org/security/2022/dsa-5053"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815","description":"path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path."}]},{"artifact":{"id":"e0c6a93aa7e9617e","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16865","versionConstraint":"< 215-17+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16865","fix":{"state":"fixed","versions":["215-17+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"risk":1.508,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16865"},"relatedVulnerabilities":[{"id":"CVE-2018-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"urls":["http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html","http://seclists.org/fulldisclosure/2019/May/21","http://www.openwall.com/lists/oss-security/2019/05/10/4","http://www.openwall.com/lists/oss-security/2021/07/20/2","http://www.securityfocus.com/bid/106525","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0049","https://access.redhat.com/errata/RHSA-2019:0204","https://access.redhat.com/errata/RHSA-2019:0271","https://access.redhat.com/errata/RHSA-2019:0342","https://access.redhat.com/errata/RHSA-2019:0361","https://access.redhat.com/errata/RHSA-2019:2402","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865","https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html","https://seclists.org/bugtraq/2019/May/25","https://security.gentoo.org/glsa/201903-07","https://security.netapp.com/advisory/ntap-20190117-0001/","https://usn.ubuntu.com/3855-1/","https://www.debian.org/security/2019/dsa-4367","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.qualys.com/2019/01/09/system-down/system-down.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16865","description":"An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable."}]},{"artifact":{"id":"2b62d95a9e611fdf","cpes":["cpe:2.3:a:libudev1:libudev1:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16865","versionConstraint":"< 215-17+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16865","fix":{"state":"fixed","versions":["215-17+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"risk":1.508,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16865"},"relatedVulnerabilities":[{"id":"CVE-2018-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"urls":["http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html","http://seclists.org/fulldisclosure/2019/May/21","http://www.openwall.com/lists/oss-security/2019/05/10/4","http://www.openwall.com/lists/oss-security/2021/07/20/2","http://www.securityfocus.com/bid/106525","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0049","https://access.redhat.com/errata/RHSA-2019:0204","https://access.redhat.com/errata/RHSA-2019:0271","https://access.redhat.com/errata/RHSA-2019:0342","https://access.redhat.com/errata/RHSA-2019:0361","https://access.redhat.com/errata/RHSA-2019:2402","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865","https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html","https://seclists.org/bugtraq/2019/May/25","https://security.gentoo.org/glsa/201903-07","https://security.netapp.com/advisory/ntap-20190117-0001/","https://usn.ubuntu.com/3855-1/","https://www.debian.org/security/2019/dsa-4367","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.qualys.com/2019/01/09/system-down/system-down.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16865","description":"An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable."}]},{"artifact":{"id":"e450ef05193f69e3","cpes":["cpe:2.3:a:systemd:systemd:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/debian/systemd@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.list"},{"path":"/var/lib/dpkg/info/systemd.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postinst"},{"path":"/var/lib/dpkg/info/systemd.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postrm"},{"path":"/var/lib/dpkg/info/systemd.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.preinst"},{"path":"/var/lib/dpkg/info/systemd.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.prerm"},{"path":"/var/lib/dpkg/info/systemd.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-16865","versionConstraint":"< 215-17+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16865","fix":{"state":"fixed","versions":["215-17+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"risk":1.508,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16865"},"relatedVulnerabilities":[{"id":"CVE-2018-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"urls":["http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html","http://seclists.org/fulldisclosure/2019/May/21","http://www.openwall.com/lists/oss-security/2019/05/10/4","http://www.openwall.com/lists/oss-security/2021/07/20/2","http://www.securityfocus.com/bid/106525","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0049","https://access.redhat.com/errata/RHSA-2019:0204","https://access.redhat.com/errata/RHSA-2019:0271","https://access.redhat.com/errata/RHSA-2019:0342","https://access.redhat.com/errata/RHSA-2019:0361","https://access.redhat.com/errata/RHSA-2019:2402","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865","https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html","https://seclists.org/bugtraq/2019/May/25","https://security.gentoo.org/glsa/201903-07","https://security.netapp.com/advisory/ntap-20190117-0001/","https://usn.ubuntu.com/3855-1/","https://www.debian.org/security/2019/dsa-4367","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.qualys.com/2019/01/09/system-down/system-down.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16865","description":"An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable."}]},{"artifact":{"id":"59a35c804cdace6f","cpes":["cpe:2.3:a:systemd-sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd-sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd-sysv","purl":"pkg:deb/debian/systemd-sysv@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd-sysv/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd-sysv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.list"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16865","versionConstraint":"< 215-17+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16865","fix":{"state":"fixed","versions":["215-17+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"risk":1.508,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16865"},"relatedVulnerabilities":[{"id":"CVE-2018-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"urls":["http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html","http://seclists.org/fulldisclosure/2019/May/21","http://www.openwall.com/lists/oss-security/2019/05/10/4","http://www.openwall.com/lists/oss-security/2021/07/20/2","http://www.securityfocus.com/bid/106525","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0049","https://access.redhat.com/errata/RHSA-2019:0204","https://access.redhat.com/errata/RHSA-2019:0271","https://access.redhat.com/errata/RHSA-2019:0342","https://access.redhat.com/errata/RHSA-2019:0361","https://access.redhat.com/errata/RHSA-2019:2402","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865","https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html","https://seclists.org/bugtraq/2019/May/25","https://security.gentoo.org/glsa/201903-07","https://security.netapp.com/advisory/ntap-20190117-0001/","https://usn.ubuntu.com/3855-1/","https://www.debian.org/security/2019/dsa-4367","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.qualys.com/2019/01/09/system-down/system-down.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16865","description":"An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable."}]},{"artifact":{"id":"29e72562c3e4b088","cpes":["cpe:2.3:a:udev:udev:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/debian/udev@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.prerm"},{"path":"/var/lib/dpkg/info/udev.templates","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.templates"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16865","versionConstraint":"< 215-17+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16865","fix":{"state":"fixed","versions":["215-17+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"risk":1.508,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16865"},"relatedVulnerabilities":[{"id":"CVE-2018-16865","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16865","cwe":"CWE-770","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16865","date":"2026-10-08","epss":0.03016,"percentile":0.87035}],"urls":["http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html","http://seclists.org/fulldisclosure/2019/May/21","http://www.openwall.com/lists/oss-security/2019/05/10/4","http://www.openwall.com/lists/oss-security/2021/07/20/2","http://www.securityfocus.com/bid/106525","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0049","https://access.redhat.com/errata/RHSA-2019:0204","https://access.redhat.com/errata/RHSA-2019:0271","https://access.redhat.com/errata/RHSA-2019:0342","https://access.redhat.com/errata/RHSA-2019:0361","https://access.redhat.com/errata/RHSA-2019:2402","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865","https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html","https://seclists.org/bugtraq/2019/May/25","https://security.gentoo.org/glsa/201903-07","https://security.netapp.com/advisory/ntap-20190117-0001/","https://usn.ubuntu.com/3855-1/","https://www.debian.org/security/2019/dsa-4367","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.qualys.com/2019/01/09/system-down/system-down.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16865","description":"An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3f63-hfp8-52jq","versionConstraint":"<10.2.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-3f63-hfp8-52jq","fix":{"state":"fixed","versions":["10.2.0"],"available":[{"date":"2024-01-23","kind":"first-observed","version":"10.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50447","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50447","cwe":"CWE-95","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50447","date":"2026-10-08","epss":0.01703,"percentile":0.76541}],"risk":1.507155,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-50447","https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a","https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security","http://www.openwall.com/lists/oss-security/2024/01/20/1","https://github.com/python-pillow/Pillow/releases","https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html","https://devhub.checkmarx.com/cve-details/CVE-2023-50447","https://duartecsantos.github.io/2023-01-02-CVE-2023-50447","https://duartecsantos.github.io/2024-01-02-CVE-2023-50447"],"severity":"Critical","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3f63-hfp8-52jq","description":"Arbitrary Code Execution in Pillow"},"relatedVulnerabilities":[{"id":"CVE-2023-50447","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50447","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50447","cwe":"CWE-95","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50447","date":"2026-10-08","epss":0.01703,"percentile":0.76541}],"urls":["http://www.openwall.com/lists/oss-security/2024/01/20/1","https://devhub.checkmarx.com/cve-details/CVE-2023-50447/","https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/","https://github.com/python-pillow/Pillow/releases","https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447","description":"Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter)."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w4vg-rf63-f3j3","versionConstraint":"<3.3.2 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-w4vg-rf63-f3j3","fix":{"state":"fixed","versions":["3.3.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"3.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9190","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9190","date":"2026-10-08","epss":0.01897,"percentile":0.79011}],"risk":1.4938875,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-9190","https://github.com/python-pillow/Pillow/issues/2105","https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af","https://security.gentoo.org/glsa/201612-52","http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","http://www.debian.org/security/2016/dsa-3710","http://www.securityfocus.com/bid/94234","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3","description":"Arbitrary code using \"crafted image file\" approach affecting Pillow"},"relatedVulnerabilities":[{"id":"CVE-2016-9190","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9190","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9190","date":"2026-10-08","epss":0.01897,"percentile":0.79011}],"urls":["http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","http://www.debian.org/security/2016/dsa-3710","http://www.securityfocus.com/bid/94234","https://github.com/python-pillow/Pillow/issues/2105","https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af","https://security.gentoo.org/glsa/201612-52"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-68w8-qjq3-2gfm","versionConstraint":"<2.2.24 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-68w8-qjq3-2gfm","fix":{"state":"fixed","versions":["2.2.24"],"available":[{"date":"2021-06-11","kind":"first-observed","version":"2.2.24"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33203","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33203","date":"2026-10-08","epss":0.02737,"percentile":0.8569}],"risk":1.491665,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33203","https://groups.google.com/forum/#!forum/django-announce","https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90","https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f","https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9","https://docs.djangoproject.com/en/3.2/releases/security","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-98.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV","https://security.netapp.com/advisory/ntap-20210727-0004","https://www.djangoproject.com/weblog/2021/jun/02/security-releases"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-68w8-qjq3-2gfm","description":"Path Traversal in Django"},"relatedVulnerabilities":[{"id":"CVE-2021-33203","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33203","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33203","date":"2026-10-08","epss":0.02737,"percentile":0.8569}],"urls":["https://docs.djangoproject.com/en/3.2/releases/security/","https://groups.google.com/forum/#%21forum/django-announce","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/","https://security.netapp.com/advisory/ntap-20210727-0004/","https://www.djangoproject.com/weblog/2021/jun/02/security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33203","description":"Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories."}]},{"artifact":{"id":"7f5c050ce0f21465","cpes":["cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\)project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:alex_clark_\\(fork_author\\):pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark_project:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclarkproject:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:aclark:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pillow:pillow:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pillow:3.2.0:*:*:*:*:*:*:*"],"name":"pillow","purl":"pkg:pypi/pillow@3.2.0","type":"python","version":"3.2.0","language":"python","licenses":["Standard PIL License"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Pillow-3.2.0-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vqcj-wrf2-7v73","versionConstraint":"<8.1.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pillow","version":"3.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vqcj-wrf2-7v73","fix":{"state":"fixed","versions":["8.1.0"],"available":[{"date":"2021-03-19","kind":"first-observed","version":"8.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35654","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35654","date":"2026-10-08","epss":0.01817,"percentile":0.78061}],"risk":1.4717699999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35654","https://pillow.readthedocs.io/en/stable/releasenotes/index.html","https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73","description":"Pillow Out-of-bounds Write"},"relatedVulnerabilities":[{"id":"CVE-2020-35654","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35654","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35654","date":"2026-10-08","epss":0.01817,"percentile":0.78061}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","https://pillow.readthedocs.io/en/stable/releasenotes/index.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35654","description":"In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode."}]},{"artifact":{"id":"67a8e0ff8b936e18","cpes":["cpe:2.3:a:cpp-4.9:cpp-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:cpp-4.9:cpp_4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:cpp_4.9:cpp_4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_4.9:4.9.2-10:*:*:*:*:*:*:*"],"name":"cpp-4.9","purl":"pkg:deb/debian/cpp-4.9@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/cpp-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/cpp-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-4.9.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/cpp-4.9.list"}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"31a2e6be479ce3bd","cpes":["cpe:2.3:a:gcc-4.9:gcc-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9:4.9.2-10:*:*:*:*:*:*:*"],"name":"gcc-4.9","purl":"pkg:deb/debian/gcc-4.9@4.9.2-10?arch=amd64&distro=debian-8.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/gcc-4.9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/gcc-4.9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/gcc-4.9.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"c9b0db58fe9413e5","cpes":["cpe:2.3:a:gcc-4.9-base:gcc-4.9-base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9-base:gcc_4.9_base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc-4.9-base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc_4.9_base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc-4.9-base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9_base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9-base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9_base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9-base:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9_base:4.9.2-10:*:*:*:*:*:*:*"],"name":"gcc-4.9-base","purl":"pkg:deb/debian/gcc-4.9-base@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/gcc-4.9-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"31811dd2e41810d0","cpes":["cpe:2.3:a:libasan1:libasan1:4.9.2-10:*:*:*:*:*:*:*"],"name":"libasan1","purl":"pkg:deb/debian/libasan1@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libasan1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasan1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libasan1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"a1228852b5b2d923","cpes":["cpe:2.3:a:libatomic1:libatomic1:4.9.2-10:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libatomic1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"e9a18a678f3f4368","cpes":["cpe:2.3:a:libcilkrts5:libcilkrts5:4.9.2-10:*:*:*:*:*:*:*"],"name":"libcilkrts5","purl":"pkg:deb/debian/libcilkrts5@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libcilkrts5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libcilkrts5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"7ea568adac0b3961","cpes":["cpe:2.3:a:libgcc-4.9-dev:libgcc-4.9-dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9-dev:libgcc_4.9_dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc-4.9-dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9_dev:libgcc_4.9_dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc-4.9-dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-4.9:libgcc_4.9_dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc-4.9-dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_4.9:libgcc_4.9_dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-4.9-dev:4.9.2-10:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_4.9_dev:4.9.2-10:*:*:*:*:*:*:*"],"name":"libgcc-4.9-dev","purl":"pkg:deb/debian/libgcc-4.9-dev@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libgcc-4.9-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgcc-4.9-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"61c14569a44eb572","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:4.9.2-10:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/debian/libgcc1@1%3A4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9%404.9.2-10","type":"deb","version":"1:4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9","version":"4.9.2-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"5ffb245dabb89db6","cpes":["cpe:2.3:a:libgomp1:libgomp1:4.9.2-10:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/debian/libgomp1@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"5a6630cff6358d0c","cpes":["cpe:2.3:a:libitm1:libitm1:4.9.2-10:*:*:*:*:*:*:*"],"name":"libitm1","purl":"pkg:deb/debian/libitm1@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libitm1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libitm1:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libitm1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"5e92d4bd25c6bb95","cpes":["cpe:2.3:a:liblsan0:liblsan0:4.9.2-10:*:*:*:*:*:*:*"],"name":"liblsan0","purl":"pkg:deb/debian/liblsan0@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/liblsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/liblsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"ca3e370fa09ea96e","cpes":["cpe:2.3:a:libquadmath0:libquadmath0:4.9.2-10:*:*:*:*:*:*:*"],"name":"libquadmath0","purl":"pkg:deb/debian/libquadmath0@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libquadmath0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libquadmath0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"88ba0a11aff83ccb","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:4.9.2-10:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"807447440a4ea6c1","cpes":["cpe:2.3:a:libtsan0:libtsan0:4.9.2-10:*:*:*:*:*:*:*"],"name":"libtsan0","purl":"pkg:deb/debian/libtsan0@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libtsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"67ff2b3efaea6926","cpes":["cpe:2.3:a:libubsan0:libubsan0:4.9.2-10:*:*:*:*:*:*:*"],"name":"libubsan0","purl":"pkg:deb/debian/libubsan0@4.9.2-10?arch=amd64&distro=debian-8.9&upstream=gcc-4.9","type":"deb","version":"4.9.2-10","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libubsan0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libubsan0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"gcc-4.9","version":"4.9.2-10"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-5276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"risk":1.4705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-5276"},"relatedVulnerabilities":[{"id":"CVE-2015-5276","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5276","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5276","date":"2026-10-08","epss":0.02941,"percentile":0.8672}],"urls":["http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html","http://www.securitytracker.com/id/1034375","https://bugzilla.redhat.com/show_bug.cgi?id=1262846","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5276","description":"The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-9318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9318","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9318"},"relatedVulnerabilities":[{"id":"CVE-2016-9318","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"urls":["http://www.securityfocus.com/bid/94347","https://bugzilla.gnome.org/show_bug.cgi?id=772726","https://github.com/lsh123/xmlsec/issues/43","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9318","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9318"},"relatedVulnerabilities":[{"id":"CVE-2016-9318","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-9318","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9318","date":"2026-10-08","epss":0.02938,"percentile":0.86707}],"urls":["http://www.securityfocus.com/bid/94347","https://bugzilla.gnome.org/show_bug.cgi?id=772726","https://github.com/lsh123/xmlsec/issues/43","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201711-01","https://usn.ubuntu.com/3739-1/","https://usn.ubuntu.com/3739-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15412","versionConstraint":"< 2.9.1+dfsg1-5+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15412","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-15412","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15412","date":"2026-10-08","epss":0.02938,"percentile":0.86705}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4086-1","link":"https://security-tracker.debian.org/tracker/DSA-4086-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15412"},"relatedVulnerabilities":[{"id":"CVE-2017-15412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15412","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15412","date":"2026-10-08","epss":0.02938,"percentile":0.86705}],"urls":["http://www.securitytracker.com/id/1040348","https://access.redhat.com/errata/RHSA-2017:3401","https://access.redhat.com/errata/RHSA-2018:0287","https://bugzilla.gnome.org/show_bug.cgi?id=783160","https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","https://crbug.com/727039","https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html","https://security.gentoo.org/glsa/201801-03","https://www.debian.org/security/2018/dsa-4086"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","description":"Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-15412","versionConstraint":"< 2.9.1+dfsg1-5+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15412","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-15412","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15412","date":"2026-10-08","epss":0.02938,"percentile":0.86705}],"risk":1.469,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4086-1","link":"https://security-tracker.debian.org/tracker/DSA-4086-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15412"},"relatedVulnerabilities":[{"id":"CVE-2017-15412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15412","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15412","date":"2026-10-08","epss":0.02938,"percentile":0.86705}],"urls":["http://www.securitytracker.com/id/1040348","https://access.redhat.com/errata/RHSA-2017:3401","https://access.redhat.com/errata/RHSA-2018:0287","https://bugzilla.gnome.org/show_bug.cgi?id=783160","https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","https://crbug.com/727039","https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html","https://security.gentoo.org/glsa/201801-03","https://www.debian.org/security/2018/dsa-4086"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","description":"Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13729","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13729","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13729"},"relatedVulnerabilities":[{"id":"CVE-2017-13729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484276","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13729","description":"There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13730","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13730","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13730"},"relatedVulnerabilities":[{"id":"CVE-2017-13730","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484284","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13730","description":"There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13732","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13732","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13732"},"relatedVulnerabilities":[{"id":"CVE-2017-13732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484287","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13732","description":"There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13729","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13729","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13729"},"relatedVulnerabilities":[{"id":"CVE-2017-13729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484276","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13729","description":"There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13730","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13730","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13730"},"relatedVulnerabilities":[{"id":"CVE-2017-13730","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484284","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13730","description":"There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13732","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13732","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13732"},"relatedVulnerabilities":[{"id":"CVE-2017-13732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484287","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13732","description":"There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13729","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13729","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13729"},"relatedVulnerabilities":[{"id":"CVE-2017-13729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484276","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13729","description":"There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13730","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13730","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13730"},"relatedVulnerabilities":[{"id":"CVE-2017-13730","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484284","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13730","description":"There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13732","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13732","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13732"},"relatedVulnerabilities":[{"id":"CVE-2017-13732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484287","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13732","description":"There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13729","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13729","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13729"},"relatedVulnerabilities":[{"id":"CVE-2017-13729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484276","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13729","description":"There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13730","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13730","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13730"},"relatedVulnerabilities":[{"id":"CVE-2017-13730","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484284","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13730","description":"There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13732","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13732","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13732"},"relatedVulnerabilities":[{"id":"CVE-2017-13732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484287","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13732","description":"There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13729","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13729","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13729"},"relatedVulnerabilities":[{"id":"CVE-2017-13729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13729","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13729","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484276","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13729","description":"There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13730","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13730","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13730"},"relatedVulnerabilities":[{"id":"CVE-2017-13730","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13730","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13730","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484284","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13730","description":"There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13732","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13732","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13732"},"relatedVulnerabilities":[{"id":"CVE-2017-13732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13732","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13732","date":"2026-10-08","epss":0.0293,"percentile":0.86674}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484287","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13732","description":"There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13731","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13731","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13731"},"relatedVulnerabilities":[{"id":"CVE-2017-13731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484285","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13731","description":"There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13731","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13731","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13731"},"relatedVulnerabilities":[{"id":"CVE-2017-13731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484285","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13731","description":"There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13731","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13731","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13731"},"relatedVulnerabilities":[{"id":"CVE-2017-13731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484285","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13731","description":"There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13731","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13731","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13731"},"relatedVulnerabilities":[{"id":"CVE-2017-13731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484285","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13731","description":"There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13731","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13731","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"risk":1.465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13731"},"relatedVulnerabilities":[{"id":"CVE-2017-13731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13731","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13731","date":"2026-10-08","epss":0.0293,"percentile":0.86673}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484285","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13731","description":"There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack."}]},{"artifact":{"id":"07c839824c81605a","cpes":["cpe:2.3:a:django_software_foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django_software_foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation_project:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundationproject:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python-django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python-django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:python_django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python_django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:foundation:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:django:django:1.6.11:*:*:*:*:*:*:*","cpe:2.3:a:python:django:1.6.11:*:*:*:*:*:*:*"],"name":"django","purl":"pkg:pypi/django@1.6.11","type":"python","version":"1.6.11","language":"python","licenses":["BSD"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/Django-1.6.11.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qw25-v68c-qjf3","versionConstraint":"<4.2.26 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"django","version":"1.6.11"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-qw25-v68c-qjf3","fix":{"state":"fixed","versions":["4.2.26"],"available":[{"date":"2025-11-06","kind":"first-observed","version":"4.2.26"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64458","cwe":"CWE-407","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64458","date":"2026-10-08","epss":0.01909,"percentile":0.79156}],"risk":1.43175,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64458","https://docs.djangoproject.com/en/dev/releases/security","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases","https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242","https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac","https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f","https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qw25-v68c-qjf3","description":"Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows"},"relatedVulnerabilities":[{"id":"CVE-2025-64458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-64458","cwe":"CWE-407","type":"Secondary","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"epss":[{"cve":"CVE-2025-64458","date":"2026-10-08","epss":0.01909,"percentile":0.79156}],"urls":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/nov/05/security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64458","description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-15938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-15938","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-15938","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15938","date":"2026-10-08","epss":0.04726,"percentile":0.91606}],"risk":1.4178,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-15938"},"relatedVulnerabilities":[{"id":"CVE-2017-15938","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15938","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15938","date":"2026-10-08","epss":0.04726,"percentile":0.91606}],"urls":["http://www.securityfocus.com/bid/101610","https://blogs.gentoo.org/ago/2017/10/24/binutils-invalid-memory-read-in-find_abstract_instance_name-dwarf2-c/","https://security.gentoo.org/glsa/201801-01","https://sourceware.org/bugzilla/show_bug.cgi?id=22209","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1b86808a86077722ee4f42ff97f836b12420bb2a"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15938","description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash)."}]},{"artifact":{"id":"c785efba1000c46e","cpes":["cpe:2.3:a:libprocps3:libprocps3:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"libprocps3","purl":"pkg:deb/debian/libprocps3@2%3A3.3.9-9?arch=amd64&distro=debian-8.9&upstream=procps","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprocps3/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libprocps3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"procps"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1126","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1126","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1126","date":"2026-10-08","epss":0.01876,"percentile":0.78774}],"risk":1.407,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1126"},"relatedVulnerabilities":[{"id":"CVE-2018-1126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1126","date":"2026-10-08","epss":0.01876,"percentile":0.78774}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","http://www.securitytracker.com/id/1041057","https://access.redhat.com/errata/RHSA-2018:1700","https://access.redhat.com/errata/RHSA-2018:1777","https://access.redhat.com/errata/RHSA-2018:1820","https://access.redhat.com/errata/RHSA-2018:2267","https://access.redhat.com/errata/RHSA-2018:2268","https://access.redhat.com/errata/RHSA-2019:1944","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-2/","https://www.debian.org/security/2018/dsa-4208","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1126","description":"procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."}]},{"artifact":{"id":"de8e877fa8628b52","cpes":["cpe:2.3:a:procps:procps:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"procps","purl":"pkg:deb/debian/procps@2%3A3.3.9-9?arch=amd64&distro=debian-8.9","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/procps/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/procps/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.list"},{"path":"/var/lib/dpkg/info/procps.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.postinst"},{"path":"/var/lib/dpkg/info/procps.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.postrm"},{"path":"/var/lib/dpkg/info/procps.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.preinst"},{"path":"/var/lib/dpkg/info/procps.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/procps.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1126","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1126","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1126","date":"2026-10-08","epss":0.01876,"percentile":0.78774}],"risk":1.407,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1126"},"relatedVulnerabilities":[{"id":"CVE-2018-1126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1126","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1126","date":"2026-10-08","epss":0.01876,"percentile":0.78774}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","http://www.securitytracker.com/id/1041057","https://access.redhat.com/errata/RHSA-2018:1700","https://access.redhat.com/errata/RHSA-2018:1777","https://access.redhat.com/errata/RHSA-2018:1820","https://access.redhat.com/errata/RHSA-2018:2267","https://access.redhat.com/errata/RHSA-2018:2268","https://access.redhat.com/errata/RHSA-2019:1944","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-2/","https://www.debian.org/security/2018/dsa-4208","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1126","description":"procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."}]},{"artifact":{"id":"e9bcfc704cee792c","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"8f4ff33619882fd1","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"a1c91ab754578fc9","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"d12534a6470be934","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"dd7de04c6f6544ab","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2694","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-2694","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"risk":1.4035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-2694"},"relatedVulnerabilities":[{"id":"CVE-2015-2694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2694","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2694","date":"2026-10-08","epss":0.02807,"percentile":0.86082}],"urls":["http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/74824","http://www.ubuntu.com/usn/USN-2810-1","https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2694","description":"The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c."}]},{"artifact":{"id":"766218805d7dd9d0","cpes":["cpe:2.3:a:httplib2_project:httplib2:0.10.3:*:*:*:*:python:*:*","cpe:2.3:a:httplib2_project:httplib2:0.10.3:*:*:*:*:*:*:*"],"name":"httplib2","purl":"pkg:pypi/httplib2@0.10.3","type":"python","version":"0.10.3","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/PKG-INFO","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/PKG-INFO","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/installed-files.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/installed-files.txt","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/httplib2-0.10.3-py2.7.egg-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gg84-qgv9-w4pq","versionConstraint":"<0.18.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"httplib2","version":"0.10.3"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gg84-qgv9-w4pq","fix":{"state":"fixed","versions":["0.18.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"0.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11078","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11078","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11078","date":"2026-10-08","epss":0.02407,"percentile":0.83567}],"risk":1.3900425,"urls":["https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e","https://nvd.nist.gov/vuln/detail/CVE-2020-11078","https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89@%3Ccommits.allura.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html","https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1@%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202@%3Cissues.beam.apache.org%3E","https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2020-46.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gg84-qgv9-w4pq","description":"CRLF injection in httplib2"},"relatedVulnerabilities":[{"id":"CVE-2020-11078","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11078","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11078","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11078","date":"2026-10-08","epss":0.02407,"percentile":0.83567}],"urls":["https://github.com/httplib2/httplib2/commit/a1457cc31f3206cf691d11d2bf34e98865873e9e","https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","https://lists.apache.org/thread.html/r23711190c2e98152cb6f216b95090d5eeb978543bb7e0bad22ce47fc%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r4d35dac106fab979f0db75a07fc4e320ad848b722103e79667ff99e1%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r69a462e690b5f2c3d418a288a2c98ae764d58587bd0b5d6ab141f25f%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/r7f364000066748299b331b615ba51c62f55ab5b201ddce9a22d98202%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rad8872fc99f670958c2774e2bf84ee32a3a0562a0c787465cf3dfa23%40%3Cissues.beam.apache.org%3E","https://lists.apache.org/thread.html/rc9eff9572946142b657c900fe63ea4bbd3535911e8d4ce4d08fe4b89%40%3Ccommits.allura.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXCX2AWROGWGY5GXR7VN3BKF34A2FO6J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZJ3D6JSM7CFZESZZKGUW2VX55BOSOXI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11078","description":"In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6131","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-6131","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6131","date":"2026-10-08","epss":0.04619,"percentile":0.91452}],"risk":1.3857,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6131"},"relatedVulnerabilities":[{"id":"CVE-2016-6131","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6131","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6131","date":"2026-10-08","epss":0.04619,"percentile":0.91452}],"urls":["http://www.openwall.com/lists/oss-security/2016/06/30/4","http://www.openwall.com/lists/oss-security/2016/06/30/7","http://www.securityfocus.com/bid/91519","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71696","https://gcc.gnu.org/ml/gcc-patches/2016-06/msg02030.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6131","description":"The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types."}]},{"artifact":{"id":"7321d398eb2e6b87","cpes":["cpe:2.3:a:hynek_schlawack_project:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack_project:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack_project:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawackproject:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hynek_schlawack:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs_project:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:python-pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:python_pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hsproject:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:pyopenssl:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyopenssl:17.2.0:*:*:*:*:*:*:*","cpe:2.3:a:hs:pyopenssl:17.2.0:*:*:*:*:*:*:*"],"name":"pyopenssl","purl":"pkg:pypi/pyopenssl@17.2.0","type":"python","version":"17.2.0","language":"python","licenses":["Apache License, Version 2.0"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/pyOpenSSL-17.2.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"17.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2rcm-phc9-3945","versionConstraint":"<17.5.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyopenssl","version":"17.2.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-2rcm-phc9-3945","fix":{"state":"fixed","versions":["17.5.0"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"17.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000808","cwe":"CWE-404","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000808","date":"2026-10-08","epss":0.01895,"percentile":0.78999}],"risk":1.3786125000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000808","https://github.com/pyca/pyopenssl/pull/723","https://access.redhat.com/errata/RHSA-2019:0085","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html","https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509","https://github.com/pypa/advisory-database/tree/main/vulns/pyopenssl/PYSEC-2018-24.yaml","https://usn.ubuntu.com/3813-1"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2rcm-phc9-3945","description":"Pyopenssl Incorrect Memory Management"},"relatedVulnerabilities":[{"id":"CVE-2018-1000808","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000808","cwe":"CWE-404","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000808","date":"2026-10-08","epss":0.01895,"percentile":0.78999}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html","https://access.redhat.com/errata/RHSA-2019:0085","https://github.com/pyca/pyopenssl/pull/723","https://usn.ubuntu.com/3813-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000808","description":"Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13733","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13733","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"risk":1.3785,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13733"},"relatedVulnerabilities":[{"id":"CVE-2017-13733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484290","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13733","description":"There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13733","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13733","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"risk":1.3785,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13733"},"relatedVulnerabilities":[{"id":"CVE-2017-13733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484290","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13733","description":"There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13733","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13733","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"risk":1.3785,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13733"},"relatedVulnerabilities":[{"id":"CVE-2017-13733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484290","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13733","description":"There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.9&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13733","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13733","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"risk":1.3785,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13733"},"relatedVulnerabilities":[{"id":"CVE-2017-13733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484290","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13733","description":"There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.9&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-13733","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13733","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"risk":1.3785,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13733"},"relatedVulnerabilities":[{"id":"CVE-2017-13733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13733","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13733","date":"2026-10-08","epss":0.02757,"percentile":0.85826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1484290","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13733","description":"There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack."}]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-5130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5130","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"risk":1.3565,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5130"},"relatedVulnerabilities":[{"id":"CVE-2017-5130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"urls":["http://bugzilla.gnome.org/show_bug.cgi?id=783026","http://www.securityfocus.com/bid/101482","https://access.redhat.com/errata/RHSA-2017:2997","https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","https://crbug.com/722079","https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed","https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201710-24","https://security.netapp.com/advisory/ntap-20190719-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5130","description":"An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5130","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"risk":1.3565,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5130"},"relatedVulnerabilities":[{"id":"CVE-2017-5130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5130","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-5130","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-5130","date":"2026-10-08","epss":0.02713,"percentile":0.85565}],"urls":["http://bugzilla.gnome.org/show_bug.cgi?id=783026","http://www.securityfocus.com/bid/101482","https://access.redhat.com/errata/RHSA-2017:2997","https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","https://crbug.com/722079","https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed","https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://security.gentoo.org/glsa/201710-24","https://security.netapp.com/advisory/ntap-20190719-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5130","description":"An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file."}]},{"artifact":{"id":"94eee2f052d8b91f","cpes":["cpe:2.3:a:lxml:lxml:3.8.0:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@3.8.0","type":"python","version":"3.8.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.9.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wrxv-2j5q-m38w","versionConstraint":"<4.9.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"3.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wrxv-2j5q-m38w","fix":{"state":"fixed","versions":["4.9.1"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.9.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2309","cwe":"CWE-476","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2309","date":"2026-10-08","epss":0.02428,"percentile":0.83737}],"risk":1.34754,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-2309","https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://github.com/lxml/lxml/blob/master/CHANGES.txt","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","https://security.gentoo.org/glsa/202208-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","https://security.netapp.com/advisory/ntap-20220915-0006","https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w","description":"lxml NULL Pointer Dereference allows attackers to cause a denial of service"},"relatedVulnerabilities":[{"id":"CVE-2022-2309","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2309","cwe":"CWE-476","type":"Secondary","source":"security@huntr.dev"}],"epss":[{"cve":"CVE-2022-2309","date":"2026-10-08","epss":0.02428,"percentile":0.83737}],"urls":["https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20220915-0006/","https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered."}]},{"artifact":{"id":"7db2891a31e973d7","cpes":["cpe:2.3:a:binutils:binutils:2.25-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:deb/debian/binutils@2.25-5%2Bdeb8u1?arch=amd64&distro=debian-8.9","type":"deb","version":"2.25-5+deb8u1","language":"","licenses":["sha256:48efc53da9d4f2d23ddfe4f005de0ab3d8b2f38b7acf8125463ef142be7ddad0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/binutils/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/binutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/binutils.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.list"},{"path":"/var/lib/dpkg/info/binutils.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postinst"},{"path":"/var/lib/dpkg/info/binutils.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.postrm"},{"path":"/var/lib/dpkg/info/binutils.shlibs","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/binutils.shlibs"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"binutils","version":"2.25-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-13710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13710","date":"2026-10-08","epss":0.02674,"percentile":0.85346}],"risk":1.337,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13710"},"relatedVulnerabilities":[{"id":"CVE-2017-13710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13710","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13710","date":"2026-10-08","epss":0.02674,"percentile":0.85346}],"urls":["http://www.securityfocus.com/bid/100499","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0c54f69295208331faab9bc5e995111a35672f9b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13710","description":"The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.11"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.6.11||>= 3.7.0, < 3.7.7||>= 3.8.0, < 3.8.2||= 3.9.0-alpha1||= 3.9.0-alpha2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.6.11","3.7.7","3.8.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"3.6.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.7.7"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e71d57982694e8f","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-18258","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-18258","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-18258","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18258","date":"2026-10-08","epss":0.02655,"percentile":0.85227}],"risk":1.3275000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-18258"},"relatedVulnerabilities":[{"id":"CVE-2017-18258","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18258","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18258","date":"2026-10-08","epss":0.02655,"percentile":0.85227}],"urls":["https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://security.netapp.com/advisory/ntap-20190719-0001/","https://usn.ubuntu.com/3739-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file."}]},{"artifact":{"id":"22beb17c2dee3852","cpes":["cpe:2.3:a:libxml2-dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2-dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2_dev:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2-dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2_dev:2.9.1\\+dfsg1-5\\+deb8u5:*:*:*:*:*:*:*"],"name":"libxml2-dev","purl":"pkg:deb/debian/libxml2-dev@2.9.1%2Bdfsg1-5%2Bdeb8u5?arch=amd64&distro=debian-8.9&upstream=libxml2","type":"deb","version":"2.9.1+dfsg1-5+deb8u5","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libxml2-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libxml2-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxml2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-18258","versionConstraint":"< 2.9.1+dfsg1-5+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u5"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-18258","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-18258","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18258","date":"2026-10-08","epss":0.02655,"percentile":0.85227}],"risk":1.3275000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-18258"},"relatedVulnerabilities":[{"id":"CVE-2017-18258","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18258","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18258","date":"2026-10-08","epss":0.02655,"percentile":0.85227}],"urls":["https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://security.netapp.com/advisory/ntap-20190719-0001/","https://usn.ubuntu.com/3739-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file."}]},{"artifact":{"id":"12b1ddfd0a9b8177","cpes":["cpe:2.3:a:python:urllib3:1.16:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@1.16","type":"python","version":"1.16","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/urllib3-1.16.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wqvq-5m8c-6g24","versionConstraint":"<1.25.9 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"1.16"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-wqvq-5m8c-6g24","fix":{"state":"fixed","versions":["1.25.9"],"available":[{"date":"2021-06-19","kind":"first-observed","version":"1.25.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26137","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26137","date":"2026-10-08","epss":0.02269,"percentile":0.82516}],"risk":1.327365,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-26137","https://github.com/urllib3/urllib3/pull/1800","https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml","https://usn.ubuntu.com/4570-1"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wqvq-5m8c-6g24","description":"CRLF injection in urllib3"},"relatedVulnerabilities":[{"id":"CVE-2020-26137","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26137","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26137","date":"2026-10-08","epss":0.02269,"percentile":0.82516}],"urls":["https://bugs.python.org/issue39603","https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","https://github.com/urllib3/urllib3/pull/1800","https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","https://usn.ubuntu.com/4570-1/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26137","description":"urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4517","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.9.23"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-4517","versionConstraint":"< 3.9.23||>= 3.10.0, < 3.10.18||>= 3.11.0, < 3.11.13||>= 3.12.0, < 3.12.11||>= 3.13.0, < 3.13.4||>= 3.14.0a1, < 3.14.0b3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-4517","fix":{"state":"fixed","versions":["3.9.23","3.10.18","3.11.13","3.12.11","3.13.4","3.14.0b3"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.9.23"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.18"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.13"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.11"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.4"},{"date":"2026-09-22","kind":"first-observed","version":"3.14.0b3"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.23"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.18"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.13"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.11"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.4"},{"date":"2025-09-04","kind":"first-observed","version":"3.14.0b3"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":9.4,"impactScore":5.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4517","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4517","date":"2026-10-08","epss":0.0143,"percentile":0.72229}],"risk":1.3156,"urls":["https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f","https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da","https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9","https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a","https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e","https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a","https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a","https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01","https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1","https://github.com/python/cpython/issues/135034","https://github.com/python/cpython/pull/135037","https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4517","description":"Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=\"data\".\n\n\nYou are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of \"data\" or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.\n\nNote that for Python 3.14 or later the default value of filter= changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links."},"relatedVulnerabilities":[]},{"artifact":{"id":"94eee2f052d8b91f","cpes":["cpe:2.3:a:lxml:lxml:3.8.0:*:*:*:*:*:*:*"],"name":"lxml","purl":"pkg:pypi/lxml@3.8.0","type":"python","version":"3.8.0","language":"python","licenses":["UNKNOWN"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/usr/local/lib/python2.7/site-packages/lxml-3.8.0.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xp26-p53h-6h2p","versionConstraint":"<4.2.5 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"lxml","version":"3.8.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-xp26-p53h-6h2p","fix":{"state":"fixed","versions":["4.2.5"],"available":[{"date":"2022-06-29","kind":"first-observed","version":"4.2.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19787","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-19787","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-19787","date":"2026-10-08","epss":0.02438,"percentile":0.83801}],"risk":1.3043299999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-19787","https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109","https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2018-12.yaml","https://usn.ubuntu.com/3841-1","https://usn.ubuntu.com/3841-2"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xp26-p53h-6h2p","description":"Improper Neutralization of Input During Web Page Generation in LXML"},"relatedVulnerabilities":[{"id":"CVE-2018-19787","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19787","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-19787","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-19787","date":"2026-10-08","epss":0.02438,"percentile":0.83801}],"urls":["https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109","https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html","https://usn.ubuntu.com/3841-1/","https://usn.ubuntu.com/3841-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-19787","description":"An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by \"j a v a s c r i p t:\" in Internet Explorer. This is a similar issue to CVE-2014-3146."}]},{"artifact":{"id":"374c6e76f2441cea","cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*","cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@2.7.13","type":"binary","version":"2.7.13","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python2.7","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/bin/python2.7","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython2.7.so.1.0","layerID":"sha256:cff0b845ede9dc29de7a5c10dd11118d0ad33714076805254479bbd4e5b22dff","accessPath":"/usr/local/lib/libpython2.7.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.8.20||>= 3.10.0a0, < 3.10.15||>= 3.11.0a0, < 3.11.10||>= 3.12.0a0, < 3.12.6||>= 3.13.0a0, < 3.13.0a1||>= 3.9.0a0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.8.20"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27043","versionConstraint":"< 3.8.20||>= 3.10.0a0, < 3.10.15||>= 3.11.0a0, < 3.11.10||>= 3.12.0a0, < 3.12.6||>= 3.13.0a0, < 3.13.0a1||>= 3.9.0a0, < 3.9.20 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:2.7.13:*:*:*:*:*:*:*"],"package":{"name":"python","version":"2.7.13"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"fixed","versions":["3.8.20","3.9.20","3.10.15","3.11.10","3.12.6","3.13.0a1"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.8.20"},{"date":"2026-09-22","kind":"first-observed","version":"3.10.15"},{"date":"2026-09-22","kind":"first-observed","version":"3.11.10"},{"date":"2026-09-22","kind":"first-observed","version":"3.12.6"},{"date":"2026-09-22","kind":"first-observed","version":"3.13.0a1"},{"date":"2026-09-22","kind":"first-observed","version":"3.9.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.8.20"},{"date":"2025-09-04","kind":"first-observed","version":"3.10.15"},{"date":"2025-09-04","kind":"first-observed","version":"3.11.10"},{"date":"2025-09-04","kind":"first-observed","version":"3.12.6"},{"date":"2025-09-04","kind":"first-observed","version":"3.13.0a1"},{"date":"2025-09-04","kind":"first-observed","version":"3.9.20"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[]},{"artifact":{"id":"bd612d098d05ddd2","cpes":["cpe:2.3:a:libjpeg-dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_dev:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg-dev","purl":"pkg:deb/debian/libjpeg-dev@1%3A1.3.1-12?arch=all&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-dev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg-dev.list"}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11213","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11213","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"risk":1.2930000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11213"},"relatedVulnerabilities":[{"id":"CVE-2018-11213","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11213","description":"An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file."}]},{"artifact":{"id":"860e9606f2e15d87","cpes":["cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo","purl":"pkg:deb/debian/libjpeg62-turbo@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11213","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11213","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"risk":1.2930000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11213"},"relatedVulnerabilities":[{"id":"CVE-2018-11213","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11213","description":"An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file."}]},{"artifact":{"id":"b7994fe5837cfe04","cpes":["cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo-dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo_dev:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62-turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62_turbo:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62-turbo-dev:1\\:1.3.1-12:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg62:libjpeg62_turbo_dev:1\\:1.3.1-12:*:*:*:*:*:*:*"],"name":"libjpeg62-turbo-dev","purl":"pkg:deb/debian/libjpeg62-turbo-dev@1%3A1.3.1-12?arch=amd64&distro=debian-8.9&upstream=libjpeg-turbo","type":"deb","version":"1:1.3.1-12","language":"","licenses":["BSD-3","BSD-BY-LC-NE","Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg62-turbo-dev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libjpeg62-turbo-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libjpeg62-turbo-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.1-12+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11213","versionConstraint":"< 1:1.3.1-12+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"libjpeg-turbo","version":"1:1.3.1-12"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11213","fix":{"state":"fixed","versions":["1:1.3.1-12+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.3.1-12+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"risk":1.2930000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11213"},"relatedVulnerabilities":[{"id":"CVE-2018-11213","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-11213","date":"2026-10-08","epss":0.02586,"percentile":0.84785}],"urls":["https://access.redhat.com/errata/RHSA-2019:2052","https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a","https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html","https://usn.ubuntu.com/3706-1/","https://usn.ubuntu.com/3706-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11213","description":"An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file."}]},{"artifact":{"id":"e9bcfc704cee792c","cpes":["cpe:2.3:a:krb5-multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5-multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5_multidev:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_multidev:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"krb5-multidev","purl":"pkg:deb/debian/krb5-multidev@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-multidev/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/krb5-multidev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-multidev.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/krb5-multidev.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"8f4ff33619882fd1","cpes":["cpe:2.3:a:libgssrpc4:libgssrpc4:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssrpc4","purl":"pkg:deb/debian/libgssrpc4@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssrpc4/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libgssrpc4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libgssrpc4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"a1c91ab754578fc9","cpes":["cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt-mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt_mit9:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5clnt:libkadm5clnt_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5clnt-mit9","purl":"pkg:deb/debian/libkadm5clnt-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5clnt-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5clnt-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5clnt-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"d12534a6470be934","cpes":["cpe:2.3:a:libkadm5srv-mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv-mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv_mit9:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv-mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkadm5srv:libkadm5srv_mit9:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkadm5srv-mit9","purl":"pkg:deb/debian/libkadm5srv-mit9@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkadm5srv-mit9/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkadm5srv-mit9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkadm5srv-mit9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"dd7de04c6f6544ab","cpes":["cpe:2.3:a:libkdb5-7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5-7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5_7:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5-7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkdb5:libkdb5_7:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkdb5-7","purl":"pkg:deb/debian/libkdb5-7@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkdb5-7/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkdb5-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkdb5-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.9&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5729","versionConstraint":"< 1.12.1+dfsg-19+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5729","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"risk":1.291,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5729"},"relatedVulnerabilities":[{"id":"CVE-2018-5729","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.7,"impactScore":3.4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5729","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5729","date":"2026-10-08","epss":0.02582,"percentile":0.84769}],"urls":["http://www.securitytracker.com/id/1042071","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3071","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869","https://bugzilla.redhat.com/show_bug.cgi?id=1551083","https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1","https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5729","description":"MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module."}]},{"artifact":{"id":"2d84cd75dfff6e09","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u4?arch=amd64&distro=debian-8.9","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"risk":1.2833,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"791ee62b4afb6930","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u4:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u4?arch=all&distro=debian-8.9&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u4","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:78aee768ddadf160803e01f1a74f4f1b19bf548a2265f50137c8803bdbd9fee0","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"risk":1.2833,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-10-08","epss":0.25666,"percentile":0.97919}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"340e22ea277765e1","cpes":["cpe:2.3:a:python_virtualenv_project:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv_project:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv_project:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenvproject:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers_project:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developersproject:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip_developers:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python-pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:python_pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python-pip:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python_pip:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:python:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pypa:pip:9.0.1:*:*:*:*:*:*:*","cpe:2.3:a:pip:pip:9.0.1:*:*:*:*:*:*:*"],"name":"pip","purl":"pkg:pypi/pip@9.0.1","type":"python","version":"9.0.1","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/METADATA","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/RECORD","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/top_level.txt","layerID":"sha256:dda0f6767edb215cd8120e44b515a22b3fcfa1c5f9015e02f0168db4a9b6c261","accessPath":"/usr/local/lib/python2.7/site-packages/pip-9.0.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"21.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5xp3-jfq3-5q8x","versionConstraint":"<21.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pip","version":"9.0.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-5xp3-jfq3-5q8x","fix":{"state":"fixed","versions":["21.1"],"available":[{"date":"2021-11-16","kind":"first-observed","version":"21.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3572","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-3572","date":"2026-10-08","epss":0.01829,"percentile":0.78207}],"risk":1.2711550000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3572","https://github.com/pypa/pip/pull/9827","https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b","https://access.redhat.com/errata/RHSA-2021:3254","https://bugzilla.redhat.com/show_bug.cgi?id=1962856","https://packetstormsecurity.com/files/162712/USN-4961-1.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20240621-0006","https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2021-437.yaml"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5xp3-jfq3-5q8x","description":"Improper Input Validation in pip"},"relatedVulnerabilities":[{"id":"CVE-2021-3572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3572","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-3572","date":"2026-10-08","epss":0.01829,"percentile":0.78207}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1962856","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3572","description":"A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1."}]},{"artifact":{"id":"e0c6a93aa7e9617e","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15688","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15688","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"risk":1.2495,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15688"},"relatedVulnerabilities":[{"id":"CVE-2018-15688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":6.5,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"urls":["http://www.securityfocus.com/bid/105745","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3665","https://access.redhat.com/errata/RHSA-2019:0049","https://github.com/systemd/systemd/pull/10518","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3806-1/","https://usn.ubuntu.com/3807-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15688","description":"A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239."}]},{"artifact":{"id":"2b62d95a9e611fdf","cpes":["cpe:2.3:a:libudev1:libudev1:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15688","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15688","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"risk":1.2495,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15688"},"relatedVulnerabilities":[{"id":"CVE-2018-15688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":6.5,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"urls":["http://www.securityfocus.com/bid/105745","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3665","https://access.redhat.com/errata/RHSA-2019:0049","https://github.com/systemd/systemd/pull/10518","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3806-1/","https://usn.ubuntu.com/3807-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15688","description":"A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239."}]},{"artifact":{"id":"e450ef05193f69e3","cpes":["cpe:2.3:a:systemd:systemd:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/debian/systemd@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.conffiles","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.list"},{"path":"/var/lib/dpkg/info/systemd.postinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postinst"},{"path":"/var/lib/dpkg/info/systemd.postrm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.postrm"},{"path":"/var/lib/dpkg/info/systemd.preinst","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.preinst"},{"path":"/var/lib/dpkg/info/systemd.prerm","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.prerm"},{"path":"/var/lib/dpkg/info/systemd.triggers","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-15688","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15688","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"risk":1.2495,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15688"},"relatedVulnerabilities":[{"id":"CVE-2018-15688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":6.5,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"urls":["http://www.securityfocus.com/bid/105745","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3665","https://access.redhat.com/errata/RHSA-2019:0049","https://github.com/systemd/systemd/pull/10518","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3806-1/","https://usn.ubuntu.com/3807-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15688","description":"A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239."}]},{"artifact":{"id":"59a35c804cdace6f","cpes":["cpe:2.3:a:systemd-sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd-sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-sysv:215-17\\+deb8u7:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_sysv:215-17\\+deb8u7:*:*:*:*:*:*:*"],"name":"systemd-sysv","purl":"pkg:deb/debian/systemd-sysv@215-17%2Bdeb8u7?arch=amd64&distro=debian-8.9&upstream=systemd","type":"deb","version":"215-17+deb8u7","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6f3b00b1ac527a2c6333a117e3c963a0461023006f4502c099a72c84ccf300a4","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd-sysv/copyright","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/usr/share/doc/systemd-sysv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.md5sums","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.list","layerID":"sha256:18f9b4e2e1bcd5abe381a557c44cba379884c88f6049564f58fd8c10ab5733df","accessPath":"/var/lib/dpkg/info/systemd-sysv.list"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15688","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.9"},"package":{"name":"systemd","version":"215-17+deb8u7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-15688","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"risk":1.2495,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-15688"},"relatedVulnerabilities":[{"id":"CVE-2018-15688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":6.5,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15688","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15688","date":"2026-10-08","epss":0.01666,"percentile":0.76031}],"urls":["http://www.securityfocus.com/bid/105745","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3665","https://access.redhat.com/errata/RHSA-2019:0049","https://github.com/systemd/systemd/pull/10518","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://security.gentoo.org/glsa/201810-10","https://usn.ubuntu.com/3806-1/","https://usn.ubuntu.com/3807-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15688","description":"A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239."}]}],"grade":"F","score":"0.00","as_of":"2026-10-09T12:49:32.334Z","grype_db_version":"2026-10-09T06:32:32.000Z"}